18-year-old browser bug affects MacOS and Linux

Cybersecurity researchers have discovered a new “0.0.0.0 Day” vulnerability that affects all major web browsers.

“The critical vulnerability reveals a fundamental flaw in the way browsers handle network requests, potentially allowing attackers to gain access to sensitive services running on devices,” said Oligo Security researcher Avi Lumelsky.

The Israeli application security company said the impact of the vulnerability is far-reaching and stems from inconsistent implementation of security mechanisms and lack of standardisation across different browsers.

As a result, a seemingly innocuous IP address, 0.0.0.0, can be used to exploit local services, leading to unauthorised access and remote code execution by attackers. This vulnerability has reportedly existed since 2006.

“Using the 0.0.0.0 address along with ‘no-cors’ mode, attackers can use public domains to attack services running on localhost and even execute arbitrary code (RCE), all with a single HTTP request.”

It should be noted that the flaw only affects Linux and MacOS devices, the vulnerability does not work on Windows.