PT-2009-4514 · Mozilla · Firefox

Ming Zhang + 3 · Published 2009-06-15 · Updated 2017-08-17 · CVE-2009-2061

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 3.0.10

Description The issue allows man-in-the-middle attackers to execute arbitrary web script in an https site's context by modifying a 3xx HTTP CONNECT response to specify a 302 redirect to an arbitrary https web site. This occurs because Mozilla Firefox processes a 3xx HTTP CONNECT response before a successful SSL handshake.

Recommendations For versions prior to 3.0.10, update to version 3.0.10 or later to resolve the issue.

Exploit

Fix

Weakness Enumeration

CWE-310

Related Identifiers

CVE-2009-2061

DSA-1820-1

DSA-1830-1

Affected Products

Firefox

References · 5

• 🔥 http://research.microsoft.com/pubs/79323/pbp-final-with-update.pdf · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-2061 · Security Note
• http://research.microsoft.com/apps/pubs/default.aspx?id=79323 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/51203 · Note
• http://securityfocus.com/bid/35412 · Note