CVE-2009-1836

Advisory lineage Upstream: 0 Downstream: 4
Modified
Published: 12 Jun 2009, 21:07
Last modified:07 Aug 2024, 05:27

Vulnerability Summary

Overall Risk (default)
medium
38/100
CVSS Score
6.8 MEDIUM
v2.0 (nvd)
EPSS Score
2.03% LOW
2% probability 0.00%
KEV
Not listed
Ransomware
No reports
Public exploits
2 found
Dark Web
Not detected

Timeline

12 Jun 2009, 21:07
Published
Vulnerability first disclosed
07 Aug 2024, 05:27
Last Modified
Vulnerability information updated

Description

Mozilla Firefox before 3.0.11, Thunderbird before 2.0.0.22, and SeaMonkey before 1.1.17 use the HTTP Host header to determine the context of a document provided in a non-200 CONNECT response from a proxy server, which allows man-in-the-middle attackers to execute arbitrary web script by modifying this CONNECT response, aka an "SSL tampering" attack.

CVSS Metrics

  • v2.0•MEDIUM•Score: 6.8AV:N/AC:M/Au:N/C:P/I:P/A:P

EPSS Trends

Current EPSS score: 2.03%• Percentile: 84%

Techniques & Countermeasures

  • CWE-287•Improper Authentication

    When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Affected Systems

  • mozilla•firefox

    ≤ 3.0.10 | 0.1 | 0.2 | 0.3 | 0.4 | 0.5 | 0.6 | 0.6.1 | 0.7 | 0.7.1 | 0.8 | 0.9 | 0.9:rc | 0.9.1 | 0.9.2 | 0.9.3 | 0.9_rc | 0.10 | 0.10.1 | 1.0 | 1.0:preview_release | 1.0.1 | 1.0.2 | 1.0.3 | 1.0.4 | 1.0.5 | 1.0.6 | 1.0.7 | 1.0.8 | 1.4.1 | 1.5 | 1.5:beta1 | 1.5:beta2 | 1.5.0.1 | 1.5.0.2 | 1.5.0.3 | 1.5.0.4 | 1.5.0.5 | 1.5.0.6 | 1.5.0.7 | 1.5.0.8 | 1.5.0.9 | 1.5.0.10 | 1.5.0.11 | 1.5.0.12 | 1.5.1 | 1.5.2 | 1.5.3 | 1.5.4 | 1.5.5 | 1.5.6 | 1.5.7 | 1.5.8 | 1.8 | 2.0 | 2.0:beta_1 | 2.0:beta1 | 2.0:rc2 | 2.0:rc3 | 2.0.0.1 | 2.0.0.2 | 2.0.0.3 | 2.0.0.4 | 2.0.0.5 | 2.0.0.6 | 2.0.0.7 | 2.0.0.8 | 2.0.0.9 | 2.0.0.10 | 2.0.0.11 | 2.0.0.12 | 2.0.0.13 | 2.0.0.14 | 2.0.0.15 | 2.0.0.16 | 2.0.0.17 | 2.0.0.18 | 2.0.0.19 | 2.0.0.20 | 2.0.0.21 | 2.0_.1 | 2.0_.4 | 2.0_.5 | 2.0_.6 | 2.0_.7 | 2.0_.9 | 2.0_.10 | 2.0_8 | 3.0 | 3.0:alpha | 3.0:beta2 | 3.0:beta5 | 3.0.1 | 3.0.2 | 3.0.3 | 3.0.4 | 3.0.5 | 3.0.6 | 3.0.7 | 3.0.8 | 3.0.9 | 3.0beta5

  • mozilla•seamonkey

    ≤ 1.1.16 | 1.0 | 1.0:alpha | 1.0:beta | 1.0.1 | 1.0.3 | 1.0.4 | 1.0.6 | 1.0.8 | 1.0.9 | 1.0.99 | 1.1 | 1.1:alpha | 1.1:beta | 1.1.1 | 1.1.3 | 1.1.5 | 1.1.5:1.1.10 | 1.1.6 | 1.1.7 | 1.1.8 | 1.1.9 | 1.1.10 | 1.1.11 | 1.1.12 | 1.1.13 | 1.1.15

  • mozilla•thunderbird

    ≤ 2.0.0.19 | 0.1 | 0.2 | 0.3 | 0.4 | 0.5 | 0.6 | 0.7 | 0.7.1 | 0.7.2 | 0.7.3 | 0.8 | 0.9 | 1.0 | 1.0.1 | 1.0.2 | 1.0.3 | 1.0.4 | 1.0.5 | 1.0.5:beta | 1.0.6 | 1.0.7 | 1.0.8 | 1.5 | 1.5:beta2 | 1.5.0.1 | 1.5.0.2 | 1.5.0.3 | 1.5.0.4 | 1.5.0.5 | 1.5.0.6 | 1.5.0.7 | 1.5.0.8 | 1.5.0.9 | 1.5.0.10 | 1.5.0.11 | 1.5.0.12 | 1.5.0.13 | 1.5.0.14 | 1.5.1 | 1.5.2 | 1.7.1 | 1.7.3 | 2.0.0.0 | 2.0.0.1 | 2.0.0.2 | 2.0.0.3 | 2.0.0.4 | 2.0.0.5 | 2.0.0.6 | 2.0.0.7 | 2.0.0.8 | 2.0.0.9 | 2.0.0.11 | 2.0.0.12 | 2.0.0.13 | 2.0.0.14 | 2.0.0.15 | 2.0.0.16 | 2.0.0.17 | 2.0.0.18 | 2.0_.4 | 2.0_.5 | 2.0_.6 | 2.0_.9 | 2.0_.12 | 2.0_.13 | 2.0_.14 | 2.0_8

References (35)