PT-2009-4515

CVE-2009-2062

Published

2009-06-15

Updated

2017-08-17

Description by

CVSS 2.0

6.8

Medium

MetricsAV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Apple Safari versions prior to 3.2.2

Description The issue allows man-in-the-middle attackers to execute arbitrary web script in an https site's context. This is achieved by modifying a 3xx HTTP CONNECT response to specify a 302 redirect to an arbitrary https web site, before a successful SSL handshake.

Recommendations For Apple Safari versions prior to 3.2.2, update to version 3.2.2 or later to resolve the issue.

Exploitability

Fix

Impacts

Researchers

Vendors

Affected products

Weakness enumeration