CVE-2009-0411: Medium severity Google Chrome vulnerability
Google Chrome before 1.0.154.46 does not properly restrict access from web pages to the (1) Set-Cookie and (2) Set-Cookie2 HTTP response headers, which allows remote attackers to obtain sensitive information from cookies via XMLHttpRequest calls and other web script.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Google Chrome (Trace Event)to a version that resolves this vulnerability.Fixed in 1.0.154.46
Event History
Frequently Asked Questions
What is the severity of CVE-2009-0411?
CVE-2009-0411 is considered a high severity vulnerability due to the potential exposure of sensitive cookie information.
How do I fix CVE-2009-0411?
To fix CVE-2009-0411, upgrade your Google Chrome to version 1.0.154.46 or later.
What types of data are affected by CVE-2009-0411?
CVE-2009-0411 affects sensitive information stored in Set-Cookie and Set-Cookie2 HTTP response headers.
Which versions of Google Chrome are affected by CVE-2009-0411?
Google Chrome versions prior to 1.0.154.46, including 0.2.152.1 to 1.0.154.42, are affected by CVE-2009-0411.
Can CVE-2009-0411 be exploited remotely?
Yes, CVE-2009-0411 can be exploited remotely via malicious web pages that perform XMLHttpRequest calls.