Cookies are often used to identify and authenticate users to a website. If an attacker can steal a user's cookies, then they can impersonate that user. The completeness of the impersonation and the actions the attacker can perform as that user depend on how the particular site uses the cookies.
This bug in Mozilla allows an attacker to, if he can convince the user's browser to load a given URL, steal their cookies for any given domain. It does not require that active scripting is enabled in the browser, and can be done with something as simple as an image tag, allowing for hassle free use in HTML email, web based email services, etc.
As expected, this bug is also present in Netscape 6.1. Upgrade to Netscape 6.2.1 or Mozilla 0.9.7 or higher, which fix this bug.
The take-away message is that, due to implementation bugs in browser and in web applications, cookies can be stolen. It is critical that any application that depends on cookies does so with an understanding of this fact, and takes appropriate measures to limit the damage that can be done using stolen cookies.
Cookies are the mechanism used by most websites to identify and authenticate a user. If you can steal someone's cookies, you can trick the server into thinking you are them. Exactly what this gains you depends on the application and how it is designed. It may gain you very little, or it may gain you a whole lot (eg. Microsoft Passport to Trouble). For more information about cookies, see The Unofficial Cookie FAQ.
Cookies are set with a specific hostname or a domain, so that they are only sent to that host or domain, with an exception or two that I won't go into here. They can also be set with a specific path, or with the secure flag, which means they will only be sent if the connection is a SSL connection. Normally, this should mean that only the server that set the cookie, or others it is operating in cooperation with (eg. in the same domain) can read it.
Mozilla has a bug that lets you bypass this protection and steal cookies for any domain. This is quite similar to bugs found in Microsoft Internet Explorer in the past, such as this one and this one. As has been shown time and time again, there are many security flaws in many Microsoft products. Sadly, they are far from being alone. There is almost certainly no web browser out there that is functional enough to browse a significant percent of current popular websites and that does not have similar security holes.
The details are very trivial. Loading a URL such as:
http://alive.znep.com%00www.passport.com/cgi-bin/cookies
...will cause Mozilla to connect to the hostname specified before the "%00", but send the cookies to the server based on the entire hostname. The "%00" is the URL encoded version of the null character, used in C to terminate strings.
This exploit can be used to steal cookies with a specific path set, and can be used to steal cookies with the secure flag set, by using the specific path and SSL in the request URL. Note, however, that cookies set for a specific hostname (eg. "www.passport.com") can not be stolen using this method, but only cookies set for an entire domain (eg. ".passport.com").
This bug was first tested on Netscape 6.1 on Windows 2000 and Mozilla 0.9.5 build 2001111503 and 0.9.5 build 20011012 on Linux. It is expected that all Netscape 6.x and Mozilla versions prior to the recently released fixed versions are vulnerable. Netscape 4.x is not vulnerable.
An example exploit is available. Very
straightforward.