PT-2009-4524

CVE-2009-2071

Publicado

2009-06-15

Atualizado

2009-06-23

Descrição por

CVSS 2.0

6.8

Média

MétricasAV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 1.0.154.53

Description The issue allows man-in-the-middle attackers to spoof an arbitrary https site. This is done by letting a browser obtain a valid certificate from the site during one request and then sending the browser a crafted 502 response page upon a subsequent request. The problem occurs when Google Chrome displays a cached certificate for a (1) 4xx or (2) 5xx CONNECT response page returned by a proxy server.

Recommendations For Google Chrome versions prior to 1.0.154.53, update to version 1.0.154.53 or later to resolve the issue.

Explorabilidade

Correção

Impactos

Pesquisadores

Adam Barth

Shuo Chen

Fornecedores

Produtos afetados

Enumeração de fraquezas

CWE-287: Improper Authentication

Identificadores relacionados