Multiple Browser HTTP Resource in HTTPS Context Security Bypass Vulnerability
BID:35403
Info
Multiple Browser HTTP Resource in HTTPS Context Security Bypass Vulnerability
| Bugtraq ID: | 35403 |
| Class: | Design Error |
| CVE: |
CVE-2009-2065 CVE-2009-2064 CVE-2009-2066 CVE-2009-2067 |
| Remote: | Yes |
| Local: | No |
| Published: | May 01 2009 12:00AM |
| Updated: | Mar 19 2015 08:49AM |
| Credit: | Shuo Chen, Ziqing Mao, Yi-Min Wang, and Ming Zhang of Microsoft Security Research |
| Vulnerable: |
SuSE openSUSE 10.3 S.u.S.E. openSUSE 11.1 S.u.S.E. openSUSE 11.0 Opera Software Opera Web Browser 8.51 Opera Software Opera Web Browser 8.50 Opera Software Opera Web Browser 8.0.2 Opera Software Opera Web Browser 8.0 2 Opera Software Opera Web Browser 8.0 1 Opera Software Opera Web Browser 8.0 Opera Software Opera Web Browser 7.54 Opera Software Opera Web Browser 7.53 Opera Software Opera Web Browser 7.52 Opera Software Opera Web Browser 7.51 Opera Software Opera Web Browser 7.50 Opera Software Opera Web Browser 7.23 Opera Software Opera Web Browser 7.22 Opera Software Opera Web Browser 7.21 Opera Software Opera Web Browser 7.20 Beta 1 build 2981 Opera Software Opera Web Browser 7.20 Opera Software Opera Web Browser 7.11 j Opera Software Opera Web Browser 7.11 b Opera Software Opera Web Browser 7.11 Opera Software Opera Web Browser 7.10 Opera Software Opera Web Browser 7.0 win32 Beta 2 Opera Software Opera Web Browser 7.0 win32 Beta 1 Opera Software Opera Web Browser 7.0 win32 Opera Software Opera Web Browser 7.0 3win32 Opera Software Opera Web Browser 7.0 2win32 Opera Software Opera Web Browser 7.0 1win32 Opera Software Opera Web Browser 6.10 linux Opera Software Opera Web Browser 6.0.5 win32 Opera Software Opera Web Browser 6.0.4 win32 Opera Software Opera Web Browser 6.0.3 win32 Opera Software Opera Web Browser 6.0.3 linux Opera Software Opera Web Browser 6.0.2 win32 Opera Software Opera Web Browser 6.0.2 linux Opera Software Opera Web Browser 6.0.1 win32 Opera Software Opera Web Browser 6.0.1 linux Opera Software Opera Web Browser 6.0.1 Opera Software Opera Web Browser 6.0 win32 Opera Software Opera Web Browser 6.0 6 Opera Software Opera Web Browser 6.0 .6win32 Opera Software Opera Web Browser 6.0 Opera Software Opera Web Browser 5.12 win32 Opera Software Opera Web Browser 5.12 Opera Software Opera Web Browser 5.1 1 win32 Opera Software Opera Web Browser 5.1 0 win32 Opera Software Opera Web Browser 5.0 Linux Opera Software Opera Web Browser 5.0 2 win32 Opera Software Opera Web Browser 5.0 Mac Opera Software Opera Web Browser 9.64 Opera Software Opera Web Browser 9.63 Opera Software Opera Web Browser 9.62 Opera Software Opera Web Browser 9.61 Opera Software Opera Web Browser 9.60 beta 1 Opera Software Opera Web Browser 9.60 Opera Software Opera Web Browser 9.52 Opera Software Opera Web Browser 9.51 Opera Software Opera Web Browser 9.50 beta Opera Software Opera Web Browser 9.5 Opera Software Opera Web Browser 9.27 Opera Software Opera Web Browser 9.26 Opera Software Opera Web Browser 9.25 Opera Software Opera Web Browser 9.24 Opera Software Opera Web Browser 9.23 Opera Software Opera Web Browser 9.22 Opera Software Opera Web Browser 9.21 Opera Software Opera Web Browser 9.20 beta 1 Opera Software Opera Web Browser 9.20 Opera Software Opera Web Browser 9.10 Opera Software Opera Web Browser 9.02 Opera Software Opera Web Browser 9.01 Opera Software Opera Web Browser 9 Opera Software Opera Web Browser 8.54 Opera Software Opera Web Browser 8.53 Opera Software Opera Web Browser 8.52 Opera Software Opera Web Browser 8 Beta 3 Mozilla Firefox 3.0.11 Mozilla Firefox 3.0.10 Mozilla Firefox 3.0.9 Mozilla Firefox 3.0.8 Mozilla Firefox 3.0.7 Beta Mozilla Firefox 3.0.7 Mozilla Firefox 3.0.6 Mozilla Firefox 3.0.5 Mozilla Firefox 3.0.4 Mozilla Firefox 3.0.3 Mozilla Firefox 3.0.2 Mozilla Firefox 3.0.1 Mozilla Firefox 2.0 20 Mozilla Firefox 2.0 .9 Mozilla Firefox 2.0 .8 Mozilla Firefox 2.0 .7 Mozilla Firefox 2.0 .6 Mozilla Firefox 2.0 .5 Mozilla Firefox 2.0 .4 Mozilla Firefox 2.0 .3 Mozilla Firefox 2.0 .19 Mozilla Firefox 2.0 .17 Mozilla Firefox 2.0 .16 Mozilla Firefox 2.0 .10 Mozilla Firefox 2.0 .1 Mozilla Firefox 3.1 Beta 3 Mozilla Firefox 3.1 Beta 2 Mozilla Firefox 3.1 Beta 1 Mozilla Firefox 3.0 Beta 5 Mozilla Firefox 3.0 Mozilla Firefox 2.0.0.2 Mozilla Firefox 2.0.0.18 Mozilla Firefox 2.0.0.15 Mozilla Firefox 2.0.0.14 Mozilla Firefox 2.0.0.13 Mozilla Firefox 2.0.0.12 Mozilla Firefox 2.0.0.11 Mozilla Firefox 2.0 RC3 Mozilla Firefox 2.0 RC2 Mozilla Firefox 2.0 beta 1 Mozilla Firefox 2.0 Microsoft Internet Explorer 7.0.5730 .11 Microsoft Internet Explorer 5.0.1 SP4 Microsoft Internet Explorer 5.0.1 SP3 Microsoft Internet Explorer 5.0.1 SP2 Microsoft Internet Explorer 5.0.1 SP1 Microsoft Internet Explorer 5.0.1 for Windows NT 4.0 Microsoft Internet Explorer 5.0.1 for Windows 98 Microsoft Internet Explorer 5.0.1 for Windows 95 Microsoft Internet Explorer 5.0.1 for Windows 2000 Microsoft Internet Explorer 5.0.1 Microsoft Internet Explorer 8 RC1 Microsoft Internet Explorer 8 beta 2 Microsoft Internet Explorer 8 Beta 1 Microsoft Internet Explorer 8 Microsoft Internet Explorer 7.0 beta3 Microsoft Internet Explorer 7.0 beta2 Microsoft Internet Explorer 7.0 beta1 Microsoft Internet Explorer 7.0 Microsoft Internet Explorer 6.0 SP1 Microsoft Internet Explorer 6.0 Microsoft Internet Explorer 5.5 SP2 Microsoft Internet Explorer 5.5 SP1 Microsoft Internet Explorer 5.5 preview Microsoft Internet Explorer 5.5 Microsoft Internet Explorer 5.0 for Windows NT 4 Microsoft Internet Explorer 5.0 for Windows 98 Microsoft Internet Explorer 5.0 for Windows 95 Microsoft Internet Explorer 5.0 for Windows 2000 Microsoft Internet Explorer 5.0 MandrakeSoft Enterprise Server 5 x86_64 MandrakeSoft Enterprise Server 5 Google Chrome 2.0.172 .31 Google Chrome 2.0.172 .30 Google Chrome 1.0.154 .61 Google Chrome 0.3.154 9 Google Chrome 0.2.149 .30 Google Chrome 0.2.149 .29 Google Chrome 0.2.149 .27 Google Chrome 1.0.154.65 Google Chrome 1.0.154.64 Google Chrome 1.0.154.59 Google Chrome 1.0.154.55 Google Chrome 1.0.154.53 Google Chrome 1.0.154.48 Google Chrome 1.0.154.46 Google Chrome 1.0.154.36 Apple Safari 3.2.3 for Windows Apple Safari 3.2.3 Apple Safari 3.2.2 for Windows Apple Safari 3.1.2 for Windows Apple Safari 3.1.2 Apple Safari 3.1.1 for Windows Apple Safari 3.1.1 Apple Safari 3.0.4 Beta for Windows Apple Safari 3.0.3 Beta for Windows Apple Safari 3.0.3 Beta Apple Safari 3.0.2 Beta for Windows Apple Safari 3.0.2 Beta Apple Safari 3.0.1 Beta for Windows Apple Safari 3.0.1 Beta Apple Safari 2.0.4 Apple Safari 2.0.3 Apple Safari 2.0.2 Apple Safari 2.0.1 Apple Safari 1.3.2 Apple Safari 1.3.1 Apple Safari 1.3 Apple Safari 1.2.3 Apple Safari 1.2.2 Apple Safari 1.2.1 Apple Safari 1.2 Apple Safari 1.1 Apple Safari 1.0 Apple Safari 4 for Windows Apple Safari 4 Beta Apple Safari 4 Apple Safari 3.2 Apple Safari 3.1 for Windows Apple Safari 3.1 Apple Safari 3 Beta for Windows Apple Safari 3 Beta Apple Safari 3 |
| Not Vulnerable: | |
Discussion
Multiple Browser HTTP Resource in HTTPS Context Security Bypass Vulnerability
Multiple browsers are prone to a security-bypass vulnerability because they fail to display warnings when pages operating in a secure context try to request resources through insecure methods.
Attackers may exploit this vulnerability to aid in phishing attacks or to obtain sensitive information. Other attacks are also possible. Note that to take advantage of this issue, an attacker must be able to intercept or control network traffic. This would normally be possible through a man-in-the-middle attack, DNS poisoning, or similar vectors.
The following are vulnerable:
Microsoft Internet Explorer
Mozilla Firefox
Apple Safari
Opera
Google Chrome
Other browsers may also be affected.
Multiple browsers are prone to a security-bypass vulnerability because they fail to display warnings when pages operating in a secure context try to request resources through insecure methods.
Attackers may exploit this vulnerability to aid in phishing attacks or to obtain sensitive information. Other attacks are also possible. Note that to take advantage of this issue, an attacker must be able to intercept or control network traffic. This would normally be possible through a man-in-the-middle attack, DNS poisoning, or similar vectors.
The following are vulnerable:
Microsoft Internet Explorer
Mozilla Firefox
Apple Safari
Opera
Google Chrome
Other browsers may also be affected.
Exploit / POC
Multiple Browser HTTP Resource in HTTPS Context Security Bypass Vulnerability
An attacker may use common networking tools to exploit this issue. Note that the attacker must entice a user into viewing a webpage that meets the conditions that allow an attack.
An attacker may use common networking tools to exploit this issue. Note that the attacker must entice a user into viewing a webpage that meets the conditions that allow an attack.
Solution / Fix
Multiple Browser HTTP Resource in HTTPS Context Security Bypass Vulnerability
Solution:
Updates are available. Please see the references for details.
MandrakeSoft Enterprise Server 5
Solution:
Updates are available. Please see the references for details.
MandrakeSoft Enterprise Server 5
-
Mandriva firefox-3.0.12-0.1mdvmes5.i586.rpm
http://www.mandriva.com/en/download/ -
Mandriva firefox-af-3.0.12-0.1mdvmes5.i586.rpm
http://www.mandriva.com/en/download/ -
Mandriva firefox-ar-3.0.12-0.1mdvmes5.i586.rpm
http://www.mandriva.com/en/download/ -
Mandriva firefox-be-3.0.12-0.1mdvmes5.i586.rpm
http://www.mandriva.com/en/download/ -
Mandriva firefox-bg-3.0.12-0.1mdvmes5.i586.rpm
http://www.mandriva.com/en/download/ -
Mandriva firefox-bn-3.0.12-0.1mdvmes5.i586.rpm
http://www.mandriva.com/en/download/ -
Mandriva firefox-ca-3.0.12-0.1mdvmes5.i586.rpm
http://www.mandriva.com/en/download/ -
Mandriva firefox-cs-3.0.12-0.1mdvmes5.i586.rpm
http://www.mandriva.com/en/download/ -
Mandriva firefox-cy-3.0.12-0.1mdvmes5.i586.rpm
http://www.mandriva.com/en/download/ -
Mandriva firefox-da-3.0.12-0.1mdvmes5.i586.rpm
http://www.mandriva.com/en/download/ -
Mandriva firefox-de-3.0.12-0.1mdvmes5.i586.rpm
http://www.mandriva.com/en/download/ -
Mandriva firefox-el-3.0.12-0.1mdvmes5.i586.rpm
http://www.mandriva.com/en/download/ -
Mandriva firefox-en_GB-3.0.12-0.1mdvmes5.i586.rpm
http://www.mandriva.com/en/download/ -
Mandriva firefox-eo-3.0.12-0.1mdvmes5.i586.rpm
http://www.mandriva.com/en/download/ -
Mandriva firefox-es_AR-3.0.12-0.1mdvmes5.i586.rpm
http://www.mandriva.com/en/download/ -
Mandriva firefox-es_ES-3.0.12-0.1mdvmes5.i586.rpm
http://www.mandriva.com/en/download/ -
Mandriva firefox-et-3.0.12-0.1mdvmes5.i586.rpm
http://www.mandriva.com/en/download/ -
Mandriva firefox-eu-3.0.12-0.1mdvmes5.i586.rpm
http://www.mandriva.com/en/download/ -
Mandriva firefox-fi-3.0.12-0.1mdvmes5.i586.rpm
http://www.mandriva.com/en/download/ -
Mandriva firefox-fr-3.0.12-0.1mdvmes5.i586.rpm
http://www.mandriva.com/en/download/ -
Mandriva firefox-fy-3.0.12-0.1mdvmes5.i586.rpm
http://www.mandriva.com/en/download/ -
Mandriva firefox-ga_IE-3.0.12-0.1mdvmes5.i586.rpm
http://www.mandriva.com/en/download/ -
Mandriva firefox-gl-3.0.12-0.1mdvmes5.i586.rpm
http://www.mandriva.com/en/download/ -
Mandriva firefox-gu_IN-3.0.12-0.1mdvmes5.i586.rpm
http://www.mandriva.com/en/download/ -
Mandriva firefox-he-3.0.12-0.1mdvmes5.i586.rpm
http://www.mandriva.com/en/download/ -
Mandriva firefox-hi-3.0.12-0.1mdvmes5.i586.rpm
http://www.mandriva.com/en/download/ -
Mandriva firefox-hu-3.0.12-0.1mdvmes5.i586.rpm
http://www.mandriva.com/en/download/ -
Mandriva firefox-id-3.0.12-0.1mdvmes5.i586.rpm
http://www.mandriva.com/en/download/ -
Mandriva firefox-is-3.0.12-0.1mdvmes5.i586.rpm
http://www.mandriva.com/en/download/ -
Mandriva firefox-it-3.0.12-0.1mdvmes5.i586.rpm
http://www.mandriva.com/en/download/ -
Mandriva firefox-ja-3.0.12-0.1mdvmes5.i586.rpm
http://www.mandriva.com/en/download/ -
Mandriva firefox-ka-3.0.12-0.1mdvmes5.i586.rpm
http://www.mandriva.com/en/download/ -
Mandriva firefox-kn-3.0.12-0.1mdvmes5.i586.rpm
http://www.mandriva.com/en/download/ -
Mandriva firefox-ko-3.0.12-0.1mdvmes5.i586.rpm
http://www.mandriva.com/en/download/ -
Mandriva firefox-ku-3.0.12-0.1mdvmes5.i586.rpm
http://www.mandriva.com/en/download/ -
Mandriva firefox-lt-3.0.12-0.1mdvmes5.i586.rpm
http://www.mandriva.com/en/download/ -
Mandriva firefox-lv-3.0.12-0.1mdvmes5.i586.rpm
http://www.mandriva.com/en/download/ -
Mandriva firefox-mk-3.0.12-0.1mdvmes5.i586.rpm
http://www.mandriva.com/en/download/ -
Mandriva firefox-mn-3.0.12-0.1mdvmes5.i586.rpm
http://www.mandriva.com/en/download/ -
Mandriva firefox-mr-3.0.12-0.1mdvmes5.i586.rpm
http://www.mandriva.com/en/download/ -
Mandriva firefox-nb_NO-3.0.12-0.1mdvmes5.i586.rpm
http://www.mandriva.com/en/download/ -
Mandriva firefox-nl-3.0.12-0.1mdvmes5.i586.rpm
http://www.mandriva.com/en/download/ -
Mandriva firefox-nn_NO-3.0.12-0.1mdvmes5.i586.rpm
http://www.mandriva.com/en/download/ -
Mandriva firefox-oc-3.0.12-0.1mdvmes5.i586.rpm
http://www.mandriva.com/en/download/ -
Mandriva firefox-pa_IN-3.0.12-0.1mdvmes5.i586.rpm
http://www.mandriva.com/en/download/ -
Mandriva firefox-pl-3.0.12-0.1mdvmes5.i586.rpm
http://www.mandriva.com/en/download/ -
Mandriva firefox-pt_BR-3.0.12-0.1mdvmes5.i586.rpm
http://www.mandriva.com/en/download/ -
Mandriva firefox-pt_PT-3.0.12-0.1mdvmes5.i586.rpm
http://www.mandriva.com/en/download/ -
Mandriva firefox-ro-3.0.12-0.1mdvmes5.i586.rpm
http://www.mandriva.com/en/download/ -
Mandriva firefox-ru-3.0.12-0.1mdvmes5.i586.rpm
http://www.mandriva.com/en/download/ -
Mandriva firefox-si-3.0.12-0.1mdvmes5.i586.rpm
http://www.mandriva.com/en/download/ -
Mandriva firefox-sk-3.0.12-0.1mdvmes5.i586.rpm
http://www.mandriva.com/en/download/ -
Mandriva firefox-sl-3.0.12-0.1mdvmes5.i586.rpm
http://www.mandriva.com/en/download/ -
Mandriva firefox-sq-3.0.12-0.1mdvmes5.i586.rpm
http://www.mandriva.com/en/download/ -
Mandriva firefox-sr-3.0.12-0.1mdvmes5.i586.rpm
http://www.mandriva.com/en/download/ -
Mandriva firefox-sv_SE-3.0.12-0.1mdvmes5.i586.rpm
http://www.mandriva.com/en/download/ -
Mandriva firefox-te-3.0.12-0.1mdvmes5.i586.rpm
http://www.mandriva.com/en/download/ -
Mandriva firefox-th-3.0.12-0.1mdvmes5.i586.rpm
http://www.mandriva.com/en/download/ -
Mandriva firefox-tr-3.0.12-0.1mdvmes5.i586.rpm
http://www.mandriva.com/en/download/ -
Mandriva firefox-uk-3.0.12-0.1mdvmes5.i586.rpm
http://www.mandriva.com/en/download/ -
Mandriva firefox-zh_CN-3.0.12-0.1mdvmes5.i586.rpm
http://www.mandriva.com/en/download/ -
Mandriva firefox-zh_TW-3.0.12-0.1mdvmes5.i586.rpm
http://www.mandriva.com/en/download/ -
Mandriva gnome-python-extras-2.19.1-20.8mdvmes5.i586.rpm
http://www.mandriva.com/en/download/ -
Mandriva gnome-python-gda-2.19.1-20.8mdvmes5.i586.rpm
http://www.mandriva.com/en/download/ -
Mandriva gnome-python-gda-devel-2.19.1-20.8mdvmes5.i586.rpm
http://www.mandriva.com/en/download/ -
Mandriva gnome-python-gdl-2.19.1-20.8mdvmes5.i586.rpm
http://www.mandriva.com/en/download/ -
Mandriva gnome-python-gtkhtml2-2.19.1-20.8mdvmes5.i586.rpm
http://www.mandriva.com/en/download/ -
Mandriva gnome-python-gtkmozembed-2.19.1-20.8mdvmes5.i586.rpm
http://www.mandriva.com/en/download/ -
Mandriva gnome-python-gtkspell-2.19.1-20.8mdvmes5.i586.rpm
http://www.mandriva.com/en/download/ -
Mandriva libxulrunner-devel-1.9.0.12-0.1mdvmes5.i586.rpm
http://www.mandriva.com/en/download/ -
Mandriva libxulrunner-unstable-devel-1.9.0.12-0.1mdvmes5.i586.rpm
http://www.mandriva.com/en/download/ -
Mandriva libxulrunner1.9-1.9.0.12-0.1mdvmes5.i586.rpm
http://www.mandriva.com/en/download/ -
Mandriva xulrunner-1.9.0.12-0.1mdvmes5.i586.rpm
http://www.mandriva.com/en/download/ -
Mandriva yelp-2.24.0-3.8mdvmes5.i586.rpm
http://www.mandriva.com/en/download/
References
Multiple Browser HTTP Resource in HTTPS Context Security Bypass Vulnerability
References:
References:
- Apple Safari Homepage (Apple)
- Google Chrome Homepage (Google)
- Internet Explorer Homepage (Microsoft)
- Opera Homepage (Opera Software)
- Pretty-Bad-Proxy: An Overlooked Adversary in Browsers�?? HTTPS Deployments (Shuo Chen, Ziqing Mao, Yi-Min Wang, and Ming Zhang)
- Cisco NX-OS Software TACACS+ Command Authorization Vulnerability (Cisco)