CVE-2009-1836

Published: Jun 12, 2009Modified: Apr 23, 2026

6.8

Vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability: 8.6 / Impact: 6.4

Source: NVD

Description

Mozilla Firefox before 3.0.11, Thunderbird before 2.0.0.22, and SeaMonkey before 1.1.17 use the HTTP Host header to determine the context of a document provided in a non-200 CONNECT response from a proxy server, which allows man-in-the-middle attackers to execute arbitrary web script by modifying this CONNECT response, aka an "SSL tampering" attack.

Affected (202)

Products: Mozilla: Firefox, Seamonkey, Thunderbird

3 products

Configuration A

202 vulnerable

Vulnerable Software	Affected Versions
Mozilla Firefox	Up to 3.0.10
Mozilla Firefox	Version 0.10.1
Mozilla Firefox	Version 0.10
Mozilla Firefox	Version 0.1
Mozilla Firefox	Version 0.2
Mozilla Firefox	Version 0.3
Mozilla Firefox	Version 0.4
Mozilla Firefox	Version 0.5
Mozilla Firefox	Version 0.6.1
Mozilla Firefox	Version 0.6
Mozilla Firefox	Version 0.7.1
Mozilla Firefox	Version 0.7
Mozilla Firefox	Version 0.8
Mozilla Firefox	Version 0.9.1
Mozilla Firefox	Version 0.9.2
Mozilla Firefox	Version 0.9.3
Mozilla Firefox	Version 0.9
Mozilla Firefox	Version 0.9 rc
Mozilla Firefox	Version 0.9_rc
Mozilla Firefox	Version 1.0.1
Mozilla Firefox	Version 1.0.2
Mozilla Firefox	Version 1.0.3
Mozilla Firefox	Version 1.0.4
Mozilla Firefox	Version 1.0.5
Mozilla Firefox	Version 1.0.6
Mozilla Firefox	Version 1.0.6
Mozilla Firefox	Version 1.0.7
Mozilla Firefox	Version 1.0.8
Mozilla Firefox	Version 1.0
Mozilla Firefox	Version 1.0 preview_release
Mozilla Firefox	Version 1.4.1
Mozilla Firefox	Version 1.5.0.10
Mozilla Firefox	Version 1.5.0.11
Mozilla Firefox	Version 1.5.0.12
Mozilla Firefox	Version 1.5.0.1
Mozilla Firefox	Version 1.5.0.2
Mozilla Firefox	Version 1.5.0.3
Mozilla Firefox	Version 1.5.0.4
Mozilla Firefox	Version 1.5.0.5
Mozilla Firefox	Version 1.5.0.6
Mozilla Firefox	Version 1.5.0.7
Mozilla Firefox	Version 1.5.0.8
Mozilla Firefox	Version 1.5.0.9
Mozilla Firefox	Version 1.5.1
Mozilla Firefox	Version 1.5.2
Mozilla Firefox	Version 1.5.3
Mozilla Firefox	Version 1.5.4
Mozilla Firefox	Version 1.5.5
Mozilla Firefox	Version 1.5.6
Mozilla Firefox	Version 1.5.7
Mozilla Firefox	Version 1.5.8
Mozilla Firefox	Version 1.5
Mozilla Firefox	Version 1.5 beta1
Mozilla Firefox	Version 1.5 beta2
Mozilla Firefox	Version 1.8
Mozilla Firefox	Version 2.0.0.10
Mozilla Firefox	Version 2.0.0.11
Mozilla Firefox	Version 2.0.0.12
Mozilla Firefox	Version 2.0.0.13
Mozilla Firefox	Version 2.0.0.14
Mozilla Firefox	Version 2.0.0.15
Mozilla Firefox	Version 2.0.0.16
Mozilla Firefox	Version 2.0.0.17
Mozilla Firefox	Version 2.0.0.18
Mozilla Firefox	Version 2.0.0.19
Mozilla Firefox	Version 2.0.0.1
Mozilla Firefox	Version 2.0.0.20
Mozilla Firefox	Version 2.0.0.21
Mozilla Firefox	Version 2.0.0.2
Mozilla Firefox	Version 2.0.0.3
Mozilla Firefox	Version 2.0.0.4
Mozilla Firefox	Version 2.0.0.5
Mozilla Firefox	Version 2.0.0.6
Mozilla Firefox	Version 2.0.0.7
Mozilla Firefox	Version 2.0.0.8
Mozilla Firefox	Version 2.0.0.9
Mozilla Firefox	Version 2.0
Mozilla Firefox	Version 2.0 beta1
Mozilla Firefox	Version 2.0 beta_1
Mozilla Firefox	Version 2.0 rc2
Mozilla Firefox	Version 2.0 rc3
Mozilla Firefox	Version 2.0_.10
Mozilla Firefox	Version 2.0_.1
Mozilla Firefox	Version 2.0_.4
Mozilla Firefox	Version 2.0_.5
Mozilla Firefox	Version 2.0_.6
Mozilla Firefox	Version 2.0_.7
Mozilla Firefox	Version 2.0_.9
Mozilla Firefox	Version 2.0_8
Mozilla Firefox	Version 3.0.1
Mozilla Firefox	Version 3.0.2
Mozilla Firefox	Version 3.0.3
Mozilla Firefox	Version 3.0.4
Mozilla Firefox	Version 3.0.5
Mozilla Firefox	Version 3.0.6
Mozilla Firefox	Version 3.0.7
Mozilla Firefox	Version 3.0.8
Mozilla Firefox	Version 3.0.9
Mozilla Firefox	Version 3.0
Mozilla Firefox	Version 3.0 alpha
Mozilla Firefox	Version 3.0 beta2
Mozilla Firefox	Version 3.0 beta5
Mozilla Firefox	Version 3.0beta5
Mozilla Seamonkey	Up to 1.1.16
Mozilla Seamonkey	Version 1.0.1
Mozilla Seamonkey	Version 1.0.3
Mozilla Seamonkey	Version 1.0.4
Mozilla Seamonkey	Version 1.0.6
Mozilla Seamonkey	Version 1.0.8
Mozilla Seamonkey	Version 1.0.99
Mozilla Seamonkey	Version 1.0.9
Mozilla Seamonkey	Version 1.0
Mozilla Seamonkey	Version 1.0
Mozilla Seamonkey	Version 1.0
Mozilla Seamonkey	Version 1.0
Mozilla Seamonkey	Version 1.0 alpha
Mozilla Seamonkey	Version 1.0 beta
Mozilla Seamonkey	Version 1.1.10
Mozilla Seamonkey	Version 1.1.11
Mozilla Seamonkey	Version 1.1.12
Mozilla Seamonkey	Version 1.1.13
Mozilla Seamonkey	Version 1.1.15
Mozilla Seamonkey	Version 1.1.1
Mozilla Seamonkey	Version 1.1.3
Mozilla Seamonkey	Version 1.1.5
Mozilla Seamonkey	Version 1.1.5 1.1.10
Mozilla Seamonkey	Version 1.1.6
Mozilla Seamonkey	Version 1.1.7
Mozilla Seamonkey	Version 1.1.8
Mozilla Seamonkey	Version 1.1.9
Mozilla Seamonkey	Version 1.1
Mozilla Seamonkey	Version 1.1 alpha
Mozilla Seamonkey	Version 1.1 beta
Mozilla Thunderbird	Up to 2.0.0.19
Mozilla Thunderbird	Version 0.1
Mozilla Thunderbird	Version 0.2
Mozilla Thunderbird	Version 0.3
Mozilla Thunderbird	Version 0.4
Mozilla Thunderbird	Version 0.5
Mozilla Thunderbird	Version 0.6
Mozilla Thunderbird	Version 0.7.1
Mozilla Thunderbird	Version 0.7.2
Mozilla Thunderbird	Version 0.7.3
Mozilla Thunderbird	Version 0.7
Mozilla Thunderbird	Version 0.8
Mozilla Thunderbird	Version 0.9
Mozilla Thunderbird	Version 1.0.1
Mozilla Thunderbird	Version 1.0.2
Mozilla Thunderbird	Version 1.0.3
Mozilla Thunderbird	Version 1.0.4
Mozilla Thunderbird	Version 1.0.5
Mozilla Thunderbird	Version 1.0.5 beta
Mozilla Thunderbird	Version 1.0.6
Mozilla Thunderbird	Version 1.0.7
Mozilla Thunderbird	Version 1.0.8
Mozilla Thunderbird	Version 1.0
Mozilla Thunderbird	Version 1.5.0.10
Mozilla Thunderbird	Version 1.5.0.11
Mozilla Thunderbird	Version 1.5.0.12
Mozilla Thunderbird	Version 1.5.0.13
Mozilla Thunderbird	Version 1.5.0.14
Mozilla Thunderbird	Version 1.5.0.1
Mozilla Thunderbird	Version 1.5.0.2
Mozilla Thunderbird	Version 1.5.0.3
Mozilla Thunderbird	Version 1.5.0.4
Mozilla Thunderbird	Version 1.5.0.5
Mozilla Thunderbird	Version 1.5.0.6
Mozilla Thunderbird	Version 1.5.0.7
Mozilla Thunderbird	Version 1.5.0.8
Mozilla Thunderbird	Version 1.5.0.9
Mozilla Thunderbird	Version 1.5.1
Mozilla Thunderbird	Version 1.5.2
Mozilla Thunderbird	Version 1.5
Mozilla Thunderbird	Version 1.5 beta2
Mozilla Thunderbird	Version 1.7.1
Mozilla Thunderbird	Version 1.7.3
Mozilla Thunderbird	Version 2.0.0.0
Mozilla Thunderbird	Version 2.0.0.11
Mozilla Thunderbird	Version 2.0.0.12
Mozilla Thunderbird	Version 2.0.0.13
Mozilla Thunderbird	Version 2.0.0.14
Mozilla Thunderbird	Version 2.0.0.15
Mozilla Thunderbird	Version 2.0.0.16
Mozilla Thunderbird	Version 2.0.0.17
Mozilla Thunderbird	Version 2.0.0.18
Mozilla Thunderbird	Version 2.0.0.1
Mozilla Thunderbird	Version 2.0.0.2
Mozilla Thunderbird	Version 2.0.0.3
Mozilla Thunderbird	Version 2.0.0.4
Mozilla Thunderbird	Version 2.0.0.5
Mozilla Thunderbird	Version 2.0.0.6
Mozilla Thunderbird	Version 2.0.0.7
Mozilla Thunderbird	Version 2.0.0.8
Mozilla Thunderbird	Version 2.0.0.9
Mozilla Thunderbird	Version 2.0_.12
Mozilla Thunderbird	Version 2.0_.13
Mozilla Thunderbird	Version 2.0_.14
Mozilla Thunderbird	Version 2.0_.4
Mozilla Thunderbird	Version 2.0_.5
Mozilla Thunderbird	Version 2.0_.6
Mozilla Thunderbird	Version 2.0_.9
Mozilla Thunderbird	Version 2.0_8

Related CWEs

CWE-287

Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

References (70)

http://osvdb.org/55160

Source: secalert@redhat.com

http://research.microsoft.com/apps/pubs/default.aspx?id=79323

Source: secalert@redhat.com

http://research.microsoft.com/pubs/79323/pbp-final-with-update.pdf

Source: secalert@redhat.com

http://secunia.com/advisories/35331

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/35415

Source: secalert@redhat.com

http://secunia.com/advisories/35431

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/35439

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/35440

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/35468

Source: secalert@redhat.com

http://secunia.com/advisories/35536

Source: secalert@redhat.com

http://secunia.com/advisories/35561

Source: secalert@redhat.com

http://secunia.com/advisories/35602

Source: secalert@redhat.com

http://secunia.com/advisories/35882

Source: secalert@redhat.com

http://slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.372468

Source: secalert@redhat.com

http://slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.425408

Source: secalert@redhat.com

http://sunsolve.sun.com/search/document.do?assetkey=1-66-264308-1

Source: secalert@redhat.com

http://www.debian.org/security/2009/dsa-1820

Source: secalert@redhat.com

http://www.debian.org/security/2009/dsa-1830

Source: secalert@redhat.com

http://www.mandriva.com/security/advisories?name=MDVSA-2009:141

Source: secalert@redhat.com

http://www.mozilla.org/security/announce/2009/mfsa2009-27.html

Source: secalert@redhat.com

Vendor Advisory

http://www.redhat.com/support/errata/RHSA-2009-1126.html

Source: secalert@redhat.com

http://www.securityfocus.com/bid/35326

Source: secalert@redhat.com

http://www.securityfocus.com/bid/35380

Source: secalert@redhat.com

http://www.securitytracker.com/id?1022396

Source: secalert@redhat.com

http://www.slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.454275

Source: secalert@redhat.com

http://www.ubuntu.com/usn/usn-782-1

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2009/1572

Source: secalert@redhat.com

PatchVendor Advisory

https://bugzilla.mozilla.org/show_bug.cgi?id=479880

Source: secalert@redhat.com

Exploit

https://bugzilla.redhat.com/show_bug.cgi?id=503578

Source: secalert@redhat.com

Exploit

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11764

Source: secalert@redhat.com

https://rhn.redhat.com/errata/RHSA-2009-1095.html

Source: secalert@redhat.com

Patch

https://www.redhat.com/archives/fedora-package-announce/2009-July/msg00444.html

Source: secalert@redhat.com

https://www.redhat.com/archives/fedora-package-announce/2009-July/msg00504.html

Source: secalert@redhat.com

https://www.redhat.com/archives/fedora-package-announce/2009-June/msg00574.html

Source: secalert@redhat.com

https://www.redhat.com/archives/fedora-package-announce/2009-June/msg00657.html

Source: secalert@redhat.com

http://osvdb.org/55160