Attacker Value

Unknown

(0 users assessed)

Exploitability

Unknown

(0 users assessed)

User Interaction

None

Privileges Required

None

Attack Vector

Network

0

CVE-2013-6673

Disclosure Date: December 11, 2013 •

CVE-2013-6673 CVSS v3 Base Score: 5.9

MITRE ATT&CK

Add MITRE ATT&CK tactics and techniques that apply to this CVE.

Description

Mozilla Firefox before 26.0, Firefox ESR 24.x before 24.2, Thunderbird before 24.2, and SeaMonkey before 2.23 do not recognize a user’s removal of trust from an EV X.509 certificate, which makes it easier for man-in-the-middle attackers to spoof SSL servers in opportunistic circumstances via a valid certificate that is unacceptable to the user.

Add Assessment

No one has assessed this topic. Be the first to add your voice to the community.

CVSS V3 Severity and Metrics

Data provided by the National Vulnerability Database (NVD)

Base Score:

5.9 Medium

Impact Score:

3.6

Exploitability Score:

2.2

Vector:

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Attack Vector (AV):

Network

Attack Complexity (AC):

High

Privileges Required (PR):

None

User Interaction (UI):

None

Scope (S):

Unchanged

Confidentiality (C):

None

Integrity (I):

High

Availability (A):

None

Vendors

canonical,
fedoraproject,
mozilla,
opensuse,
suse

Products

fedora 18,
fedora 19,
fedora 20,
firefox,
firefox esr,
linux enterprise desktop 11,
linux enterprise server 11,
opensuse 12.2,
opensuse 12.3,
opensuse 13.1,
seamonkey,
suse linux enterprise software development kit 11.0,
thunderbird,
ubuntu linux 12.04,
ubuntu linux 12.10,
ubuntu linux 13.04,
ubuntu linux 13.10

References

Canonical

CVE-2013-6673 (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6673)

BID-64213 (http://www.securityfocus.com/bid/64213)

Advisory

http://lists.opensuse.org/opensuse-updates/2013-12/msg00120.html

http://lists.opensuse.org/opensuse-security-announce/2013-12/msg00010.html

http://lists.opensuse.org/opensuse-updates/2013-12/msg00119.html

FEDORA-2013-23127 (http://lists.fedoraproject.org/pipermail/package-announce/2013-December/123437.html)

FEDORA-2013-23519 (http://lists.fedoraproject.org/pipermail/package-announce/2013-December/124257.html)

SECTRACK-1029470 (http://www.securitytracker.com/id/1029470)

http://lists.opensuse.org/opensuse-updates/2013-12/msg00086.html

http://lists.opensuse.org/opensuse-updates/2013-12/msg00121.html

GLSA-201504-01 (https://security.gentoo.org/glsa/201504-01)

http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html

http://lists.opensuse.org/opensuse-updates/2013-12/msg00085.html

http://lists.opensuse.org/opensuse-updates/2014-01/msg00002.html

SECTRACK-1029476 (http://www.securitytracker.com/id/1029476)

http://lists.opensuse.org/opensuse-updates/2013-12/msg00087.html

FEDORA-2013-23291 (http://lists.fedoraproject.org/pipermail/package-announce/2014-January/125470.html)

USN-2052-1 (http://www.ubuntu.com/usn/USN-2052-1)

https://bugzilla.mozilla.org/show_bug.cgi?id=917380

http://www.mozilla.org/security/announce/2013/mfsa2013-113.html

USN-2053-1 (http://www.ubuntu.com/usn/USN-2053-1)

FEDORA-2013-23295 (http://lists.fedoraproject.org/pipermail/package-announce/2013-December/124108.html)

Rapid7

Technical Analysis