You are here: Security Center > Mozilla Foundation Security Advisories > MFSA 2009-69

Mozilla Foundation Security Advisory 2009-69

Title: Location bar spoofing vulnerabilities
Impact: Moderate
Announced: December 15, 2009
Reporter: Jonathan Morgan, Jordi Chancel
Products: Firefox, SeaMonkey

Fixed in: Firefox 3.5.6
  Firefox 3.0.16
  SeaMonkey 2.0.1


Security researcher Jonathan Morgan reported that when a page loaded over an insecure protocol, such as http: or file:, sets its document.location to a https: URL which responds with a 204 status and empty response body, the insecure page will receive SSL indicators near the location bar, but will not have its page content modified in any way. This could lead to a user believing they were on a secure page when in fact they were not.

Security researcher Jordi Chancel reported an issue similar to one fixed in mfsa2009-44 in which a web page can set document.location to a URL that can't be displayed properly and then inject content into the resulting blank page. An attacker could use this vulnerability to place a legitimate-looking but invalid URL in the location bar and inject HTML and JavaScript into the body of the page, resulting in a spoofing attack.