PT-2009-4514 · Mozilla · Firefox

Ming Zhang + 3 · Publicado 2009-06-15 · Atualizado 2017-08-17 · CVE-2009-2061

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 3.0.10

Description The issue allows man-in-the-middle attackers to execute arbitrary web script in an https site's context by modifying a 3xx HTTP CONNECT response to specify a 302 redirect to an arbitrary https web site. This occurs because Mozilla Firefox processes a 3xx HTTP CONNECT response before a successful SSL handshake.

Recommendations For versions prior to 3.0.10, update to version 3.0.10 or later to resolve the issue.

Exploit

Correção

Enumeração de Fraquezas

CWE-310

Identificadores relacionados

CVE-2009-2061

DSA-1820-1

DSA-1830-1

Produtos afetados

Firefox

Referências · 5

• 🔥 http://research.microsoft.com/pubs/79323/pbp-final-with-update.pdf · Exploit
• http://research.microsoft.com/apps/pubs/default.aspx?id=79323 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/51203 · Nota
• http://securityfocus.com/bid/35412 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2009-2061 · Nota de Segurança