CVE-2009-2072
Summary
| CVE | CVE-2009-2072 |
|---|---|
| State | PUBLISHED |
| Assigner | mitre |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2009-06-15 19:30:05 UTC |
| Updated | 2026-04-23 00:35:47 UTC |
| Description | Apple Safari does not require a cached certificate before displaying a lock icon for an https web site, which allows man-in-the-middle attackers to spoof an arbitrary https site by sending the browser a crafted (1) 4xx or (2) 5xx CONNECT response page for an https request sent through a proxy server. |
Risk And Classification
CVSS v2.0 Breakdown
Access Vector
AdjacentAccess Complexity
MediumAuthentication
NoneConfidentiality
PartialIntegrity
PartialAvailability
PartialAV:A/AC:M/Au:N/C:P/I:P/A:P
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Apple | Safari | 0.8 | All | All | All |
| Application | Apple | Safari | 0.9 | All | All | All |
| Application | Apple | Safari | 1.0 | All | All | All |
| Application | Apple | Safari | 1.0 | beta | All | All |
| Application | Apple | Safari | 1.0 | beta2 | All | All |
| Application | Apple | Safari | 1.0.0 | All | All | All |
| Application | Apple | Safari | 1.0.0b1 | All | All | All |
| Application | Apple | Safari | 1.0.0b2 | All | All | All |
| Application | Apple | Safari | 1.0.1 | All | All | All |
| Application | Apple | Safari | 1.0.2 | All | All | All |
| Application | Apple | Safari | 1.0.3 | All | All | All |
| Application | Apple | Safari | 1.0.3 | 85.8 | All | All |
| Application | Apple | Safari | 1.0.3 | 85.8.1 | All | All |
| Application | Apple | Safari | 1.1 | All | All | All |
| Application | Apple | Safari | 1.1.0 | All | All | All |
| Application | Apple | Safari | 1.1.1 | All | All | All |
| Application | Apple | Safari | 1.2 | All | All | All |
| Application | Apple | Safari | 1.2.0 | All | All | All |
| Application | Apple | Safari | 1.2.1 | All | All | All |
| Application | Apple | Safari | 1.2.2 | All | All | All |
| Application | Apple | Safari | 1.2.3 | All | All | All |
| Application | Apple | Safari | 1.2.4 | All | All | All |
| Application | Apple | Safari | 1.2.5 | All | All | All |
| Application | Apple | Safari | 1.3 | All | All | All |
| Application | Apple | Safari | 1.3.0 | All | All | All |
| Application | Apple | Safari | 1.3.1 | All | All | All |
| Application | Apple | Safari | 1.3.2 | All | All | All |
| Application | Apple | Safari | 1.3.2 | 312.5 | All | All |
| Application | Apple | Safari | 1.3.2 | 312.6 | All | All |
| Application | Apple | Safari | 2 | All | All | All |
| Application | Apple | Safari | 2.0 | All | All | All |
| Application | Apple | Safari | 2.0.0 | All | All | All |
| Application | Apple | Safari | 2.0.1 | All | All | All |
| Application | Apple | Safari | 2.0.2 | All | All | All |
| Application | Apple | Safari | 2.0.3 | All | All | All |
| Application | Apple | Safari | 2.0.3 | 417.8 | All | All |
| Application | Apple | Safari | 2.0.3 | 417.9 | All | All |
| Application | Apple | Safari | 2.0.3 | 417.9.2 | All | All |
| Application | Apple | Safari | 2.0.3 | 417.9.3 | All | All |
| Application | Apple | Safari | 2.0.3_417.9.3 | All | All | All |
| Application | Apple | Safari | 2.0.4 | All | All | All |
| Application | Apple | Safari | 2.0.4_419.3 | All | All | All |
| Application | Apple | Safari | 2.0_pre | All | All | All |
| Application | Apple | Safari | 3 | All | All | All |
| Application | Apple | Safari | 3.0 | All | All | All |
| Application | Apple | Safari | 3.0.0 | All | All | All |
| Application | Apple | Safari | 3.0.0b | All | All | All |
| Application | Apple | Safari | 3.0.1 | All | All | All |
| Application | Apple | Safari | 3.0.1 | beta | All | All |
| Application | Apple | Safari | 3.0.1b | All | All | All |
| Application | Apple | Safari | 3.0.2 | All | All | All |
| Application | Apple | Safari | 3.0.2b | All | All | All |
| Application | Apple | Safari | 3.0.3 | All | All | All |
| Application | Apple | Safari | 3.0.3 | 522.15.5 | All | All |
| Application | Apple | Safari | 3.0.3b | All | All | All |
| Application | Apple | Safari | 3.0.4 | All | All | All |
| Application | Apple | Safari | 3.0.4b | All | All | All |
| Application | Apple | Safari | 3.0.4_beta | All | All | All |
| Application | Apple | Safari | 3.1 | All | All | All |
| Application | Apple | Safari | 3.1.0 | All | All | All |
| Application | Apple | Safari | 3.1.0b | All | All | All |
| Application | Apple | Safari | 3.1.1 | All | All | All |
| Application | Apple | Safari | 3.1.2 | All | All | All |
| Application | Apple | Safari | 3.2 | All | All | All |
| Application | Apple | Safari | 3.2.0 | All | All | All |
| Application | Apple | Safari | All | All | All | All |
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Multiple Browsers Cached Certificate HTTP Site Spoofing Vulnerability | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | |
| Pretty-Bad-Proxy: An Overlooked Adversary in Browsers' HTTPS Deployments - Microsoft Research | af854a3a-2127-422b-91ae-364da2661108 | research.microsoft.com | |
| Pretty-Bad-Proxy: An Overlooked Adversary in Browsers’ HTTPS Deployments - Microsoft Research | af854a3a-2127-422b-91ae-364da2661108 | research.microsoft.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.