PT-2008-4248 · Netscape+2 · Netscape+4
Published
2008-07-02
·
Updated
2018-10-11
·
CVE-2008-2809
CVSS v2.0
4.0
Medium
| Vector | AV:N/AC:H/Au:N/C:N/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
Mozilla versions 1.9 M8 and earlier
Mozilla Firefox versions prior to 2.0.0.15
SeaMonkey versions prior to 1.1.10
Netscape version 9.0
Description
The issue allows remote attackers to trick a user into accepting an invalid certificate for a spoofed web site. This occurs when a user accepts an SSL server certificate based on the CN domain name in the DN field, and the certificate is then regarded as accepted for all domain names in subjectAltName:dNSName fields.
Recommendations
For Mozilla versions 1.9 M8 and earlier, update to a version later than 1.9 M8 to resolve the issue.
For Mozilla Firefox versions prior to 2.0.0.15, update to version 2.0.0.15 or later.
For SeaMonkey versions prior to 1.1.10, update to version 1.1.10 or later.
For Netscape version 9.0, consider alternative browsers or update paths as Netscape 9.0 is outdated.
Fix
RCE
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Firefox
Mozilla Firefox
Netscape
Red Hat
Seamonkey