PT-2009-4523

CVE-2009-2070

Publicado

2009-06-15

Atualizado

2012-06-07

Descrição por

CVSS 2.0

6.8

Média

MétricasAV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Opera (affected versions not specified)

Description The issue allows man-in-the-middle attackers to spoof an arbitrary https site. This is done by letting a browser obtain a valid certificate from the site during one request and then sending the browser a crafted 502 response page upon a subsequent request. The attackers can exploit this by displaying a cached certificate for a (1) 4xx or (2) 5xx CONNECT response page returned by a proxy server.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Impactos

Pesquisadores

Fornecedores

Produtos afetados

Enumeração de fraquezas

CWE-287: Improper Authentication

Identificadores relacionados