NVD

Id
49102  
Name
CVE-2009-1836  
Description
Mozilla Firefox before 3.0.11, Thunderbird before 2.0.0.22, and SeaMonkey before 1.1.17 use the HTTP Host header to determine the context of a document provided in a non-200 CONNECT response from a proxy server, which allows man-in-the-middle attackers to execute arbitrary web script by modifying this CONNECT response, aka an "SSL tampering" attack.  
Reject
 
CVSS Version
2  
CVSS Score
6.8  
Severity
Medium  
CVSS Base Score
6.8  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-07  
Published
2009-06-12  
Modified Date
2010-08-21  
Seq
2009-1836  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
248331 49102 CVE-2009-1836 oval:org.mitre.oval:def:11764  View
248332 49102 CVE-2009-1836 http://research.microsoft.com/apps/pubs/default.aspx?id=79323  View
248333 49102 CVE-2009-1836 http://research.microsoft.com/pubs/79323/pbp-final-with-update.pdf  View
248334 49102 CVE-2009-1836 SSA:2009-167-01  View
248335 49102 CVE-2009-1836 SSA:2009-176-01  View
248336 49102 CVE-2009-1836 264308  View
248337 49102 CVE-2009-1836 DSA-1820  View
248338 49102 CVE-2009-1836 DSA-1830  View
248339 49102 CVE-2009-1836 MDVSA-2009:141  View
248340 49102 CVE-2009-1836 http://www.mozilla.org/security/announce/2009/mfsa2009-27.html  View
248341 49102 CVE-2009-1836 RHSA-2009:1126  View
248342 49102 CVE-2009-1836 35326  View
248343 49102 CVE-2009-1836 35380  View
248344 49102 CVE-2009-1836 1022396  View
248345 49102 CVE-2009-1836 SSA:2009-178-01  View
248346 49102 CVE-2009-1836 USN-782-1  View
248347 49102 CVE-2009-1836 ADV-2009-1572  View
248348 49102 CVE-2009-1836 https://bugzilla.mozilla.org/show_bug.cgi?id=479880  View
248349 49102 CVE-2009-1836 https://bugzilla.redhat.com/show_bug.cgi?id=503578  View
248350 49102 CVE-2009-1836 RHSA-2009:1095  View
248351 49102 CVE-2009-1836 FEDORA-2009-7567  View
248352 49102 CVE-2009-1836 FEDORA-2009-7614  View
248353 49102 CVE-2009-1836 FEDORA-2009-6366  View
248354 49102 CVE-2009-1836 FEDORA-2009-6411  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
40820 JVNDB-2009-001826 複数の Mozilla 製品における CONNECT レスポンスに関する任意の Web スクリプトを実行される脆弱性 複数の Mozilla 製品には、プロキシサーバから 200 以外の CONNECT レスポンスをする際に HTTP ホストヘッダを使用してドキュメント内容を出力するため、中間者攻撃をされ、任意の Web スクリプトを実行される脆弱性が存在します。 CVE-2009-1836 39267 CVE-2009-1836 49102 6.8 http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-001826.html 2009-06-11 2009-07-30 View