X-Frame-Options header ignored when duplicated

X-Frame-Options header ignored when duplicated

Announced

July 17, 2012

Reporter

Frédéric Buclin

Impact

Moderate

Products

Firefox, Firefox ESR, SeaMonkey, Thunderbird, Thunderbird ESR

Fixed in

• Firefox 14
• Firefox ESR 10.0.6
• SeaMonkey 2.11
• Thunderbird 14
• Thunderbird ESR 10.0.6

Description

Bugzilla developer Frédéric Buclin reported that the "X-Frame-Options header is ignored when the value is duplicated, for example X-Frame-Options: SAMEORIGIN, SAMEORIGIN. This duplication occurs for unknown reasons on some websites and when it occurs results in Mozilla browsers not being protected against possible clickjacking attacks on those pages

References

• Firefox ignores X-Frame-Options when set to SAMEORIGIN, SAMEORIGIN (duplicated header)
• CVE-2012-1961