PT-2009-4514

CVE-2009-2061

Published

2009-06-15

Updated

2017-08-17

Description by

CVSS 2.0

9.3

High

MetricsAV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 3.0.10

Description The issue allows man-in-the-middle attackers to execute arbitrary web script in an https site's context by modifying a 3xx HTTP CONNECT response to specify a 302 redirect to an arbitrary https web site. This occurs because Mozilla Firefox processes a 3xx HTTP CONNECT response before a successful SSL handshake.

Recommendations For versions prior to 3.0.10, update to version 3.0.10 or later to resolve the issue.

Exploitability

Exploit

Fix

Researchers

Vendors

Affected products

Weakness enumeration