PT-2008-4248 · Netscape+2 · Netscape+4

Published

2008-07-02

·

Updated

2018-10-11

·

CVE-2008-2809

CVSS v2.0

4.0

Medium

VectorAV:N/AC:H/Au:N/C:N/I:P/A:P
Name of the Vulnerable Software and Affected Versions Mozilla versions 1.9 M8 and earlier Mozilla Firefox versions prior to 2.0.0.15 SeaMonkey versions prior to 1.1.10 Netscape version 9.0
Description The issue allows remote attackers to trick a user into accepting an invalid certificate for a spoofed web site. This occurs when a user accepts an SSL server certificate based on the CN domain name in the DN field, and the certificate is then regarded as accepted for all domain names in subjectAltName:dNSName fields.
Recommendations For Mozilla versions 1.9 M8 and earlier, update to a version later than 1.9 M8 to resolve the issue. For Mozilla Firefox versions prior to 2.0.0.15, update to version 2.0.0.15 or later. For SeaMonkey versions prior to 1.1.10, update to version 1.1.10 or later. For Netscape version 9.0, consider alternative browsers or update paths as Netscape 9.0 is outdated.

Fix

RCE

Found an issue in the description? Have something to add? Feel free to write us 👾

Weakness Enumeration

Related Identifiers

CVE-2008-2809
DSA-1607-1
DSA-1615-1
DSA-1621-1
DSA-1697-1
RHSA-2008:0547
RHSA-2008:0549
RHSA-2008:0569
RHSA-2008:0616
RHSA-2008_0547
RHSA-2008_0549
RHSA-2008_0569
RHSA-2008_0616

Affected Products

Firefox
Mozilla Firefox
Netscape
Red Hat
Seamonkey