CVE-2009-0357: Medium severity Mozilla SeaMonkey vulnerability
Mozilla Firefox before 3.0.6 and SeaMonkey before 1.1.15 do not properly restrict access from web pages to the (1) Set-Cookie and (2) Set-Cookie2 HTTP response headers, which allows remote attackers to obtain sensitive information from cookies via XMLHttpRequest calls, related to the HTTPOnly protection mechanism.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Mozilla Firefoxto a version that resolves this vulnerability.Fixed in 3.0.6 - Upgrade
Upgrade
Mozilla SeaMonkeyto a version that resolves this vulnerability.Fixed in 1.1.15
Event History
Frequently Asked Questions
What is the severity of CVE-2009-0357?
CVE-2009-0357 is considered a moderate severity vulnerability.
How do I fix CVE-2009-0357?
To fix CVE-2009-0357, upgrade to Mozilla Firefox version 3.0.6 or later, or SeaMonkey version 1.1.15 or later.
What types of systems are affected by CVE-2009-0357?
CVE-2009-0357 affects multiple versions of Mozilla Firefox and SeaMonkey prior to specified fixed versions.
What can attackers exploit in CVE-2009-0357?
Attackers can exploit CVE-2009-0357 to access sensitive information from cookies via XMLHttpRequest calls.
Is there a workaround for CVE-2009-0357?
The most effective workaround for CVE-2009-0357 is to update to a patched version of the affected software.