PT-2009-4524

CVE-2009-2071

Published

2009-06-15

Updated

2009-06-23

Description by

CVSS 2.0

6.8

Medium

MetricsAV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 1.0.154.53

Description The issue allows man-in-the-middle attackers to spoof an arbitrary https site. This is done by letting a browser obtain a valid certificate from the site during one request and then sending the browser a crafted 502 response page upon a subsequent request. The problem occurs when Google Chrome displays a cached certificate for a (1) 4xx or (2) 5xx CONNECT response page returned by a proxy server.

Recommendations For Google Chrome versions prior to 1.0.154.53, update to version 1.0.154.53 or later to resolve the issue.

Exploitability

Fix

Impacts

Researchers

Adam Barth

Shuo Chen

Vendors

Affected products

Weakness enumeration

CWE-287: Improper Authentication

Related identifiers