CVE-2008-2809: Input Validation
Mozilla 1.9 M8 and earlier, Mozilla Firefox 2 before 2.0.0.15, SeaMonkey 1.1.5 and other versions before 1.1.10, Netscape 9.0, and other Mozilla-based web browsers, when a user accepts an SSL server certificate on the basis of the CN domain name in the DN field, regard the certificate as also accepted for all domain names in subjectAltName:dNSName fields, which makes it easier for remote attackers to trick a user into accepting an invalid certificate for a spoofed web site.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2008-2809?
CVE-2008-2809 has a moderate severity rating as it can lead to man-in-the-middle attacks due to incorrect SSL certificate validation.
How do I fix CVE-2008-2809?
To fix CVE-2008-2809, upgrade to Mozilla Firefox version 2.0.0.15 or later.
Which versions are affected by CVE-2008-2809?
CVE-2008-2809 affects Mozilla Firefox versions before 2.0.0.15, SeaMonkey 1.1.5, and other early Mozilla-based browsers.
Can CVE-2008-2809 be exploited remotely?
Yes, CVE-2008-2809 can be exploited remotely by an attacker who can impersonate a legitimate SSL server.
What are the potential impacts of exploiting CVE-2008-2809?
Exploiting CVE-2008-2809 could allow attackers to intercept and manipulate sensitive user data exchanged over SSL connections.