CVE-2009-2057: Medium severity Microsoft ie vulnerability
Published Jun 15, 2009
·Updated
Microsoft Internet Explorer before 8 uses the HTTP Host header to determine the context of a document provided in a (1) 4xx or (2) 5xx CONNECT response from a proxy server, which allows man-in-the-middle attackers to execute arbitrary web script by modifying this CONNECT response, aka an "SSL tampering" attack.
Affected Software
94 affected components
Microsoft ie=5.22
Microsoft Internet Explorer=5
Microsoft ie=6.0-sp1
Microsoft Internet Explorer=6-sp1
Microsoft Internet Explorer=5.01-sp4
Microsoft ie=5.0-sp4
Microsoft ie=6.0-sp2
Microsoft Internet Explorer=7
Microsoft ie=5.0-sp1
Microsoft Internet Explorer=6
Microsoft Internet Explorer=5.01
Microsoft Internet Explorer=5.01-sp3
Microsoft Internet Explorer=5.5-sp2
Microsoft Internet Explorer=3.0.1
Microsoft Internet Explorer=3.0.2
Microsoft Internet Explorer=3.0
Microsoft Internet Explorer=3.1
Microsoft Internet Explorer=3.2
Microsoft Internet Explorer=4.0
Microsoft Internet Explorer=4.0.1
Microsoft Internet Explorer=4.0.1-sp2
Microsoft Internet Explorer=4.0.1-sp1
Microsoft Internet Explorer=4.01
Microsoft Internet Explorer=4.01-sp1
Microsoft Internet Explorer=4.1
Microsoft Internet Explorer=4.5
Microsoft Internet Explorer=4.40.308
Microsoft Internet Explorer=4.40.520
Microsoft Internet Explorer=4.70.1155
Microsoft Internet Explorer=4.70.1158
Microsoft Internet Explorer=4.70.1215
Microsoft Internet Explorer=4.70.1300
Microsoft Internet Explorer=4.72.3612.1713
Microsoft Internet Explorer=4.71.544
Microsoft Internet Explorer=4.71.1008.3
Microsoft Internet Explorer=4.71.1712.6
Microsoft Internet Explorer=4.72.2106.8
Microsoft Internet Explorer=4.72.3110.8
Microsoft Internet Explorer=5.0
Microsoft Internet Explorer=5.0.1
Microsoft Internet Explorer=5.0.1-sp2
Microsoft Internet Explorer=5.0.1-sp3
Microsoft Internet Explorer=5.0.1-sp4
Microsoft Internet Explorer=5.0.1-sp1
Microsoft Internet Explorer=5.00.0518.10
Microsoft Internet Explorer=5.00.0910.1309
Microsoft Internet Explorer=5.00.2014.0216
Microsoft Internet Explorer=5.00.2314.1003
Microsoft Internet Explorer=5.00.2614.3500
Microsoft Internet Explorer=5.00.2919.800
Microsoft Internet Explorer=5.00.2919.3800
Microsoft Internet Explorer=5.00.2919.6307
Microsoft Internet Explorer=5.00.2920.0000
Microsoft Internet Explorer=5.00.3103.1000
Microsoft Internet Explorer=5.00.3105.0106
Microsoft Internet Explorer=5.00.3314.2101
Microsoft Internet Explorer=5.00.3315.1000
Microsoft Internet Explorer=5.00.3502.1000
Microsoft Internet Explorer=5.00.3700.1000
Microsoft Internet Explorer=5.50.3825.1300
Microsoft Internet Explorer=5.50.4030.2400
Microsoft Internet Explorer=5.50.4134.0600
Microsoft Internet Explorer=5.50.4308.2900
Microsoft Internet Explorer=5.50.4522.1800
Microsoft Internet Explorer=5.50.4807.2300
Microsoft Internet Explorer=5.5
Microsoft Internet Explorer=5.01-sp1
Microsoft Internet Explorer=5.01-sp2
Microsoft Internet Explorer=5.1
Microsoft Internet Explorer=5.2.3
Microsoft Internet Explorer=5.5-preview
Microsoft Internet Explorer=5.5-sp1
Microsoft Internet Explorer=6.0.2600
Microsoft Internet Explorer=6.00.2462.0000
Microsoft Internet Explorer=6.00.2479.0006
Microsoft Internet Explorer=6.0
Microsoft Internet Explorer=6.0.2800
Microsoft Internet Explorer=6.0.2800.1106
Microsoft Internet Explorer=6.0.2900
Microsoft Internet Explorer=6.00.2800.1106
Microsoft Internet Explorer=6.0.2900.2180
Microsoft Internet Explorer=7.0-beta
Microsoft Internet Explorer=7.0
Microsoft Internet Explorer=7.0.5730.11
Microsoft Internet Explorer=6.00.2900.2180
Microsoft Internet Explorer=6.00.3663.0000
Microsoft Internet Explorer=6.00.3790.0000
Microsoft Internet Explorer=6.00.3790.1830
Microsoft Internet Explorer=6.00.3790.3959
Microsoft Internet Explorer=7.0-beta1
Microsoft Internet Explorer=7.0-beta3
Microsoft Internet Explorer=7.00.5730.1100
Microsoft Internet Explorer=7.00.6000.16386
Microsoft Internet Explorer=7.00.6000.16441
Event History
Jun 15, 2009
CVE Published
via MITRE·07:00 PM
Data Sourced
via MITRE·07:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2009-2057?
CVE-2009-2057 is rated as critical due to its potential to allow remote code execution through crafted CONNECT responses.
2
How do I fix CVE-2009-2057?
To fix CVE-2009-2057, users should upgrade to Internet Explorer 8 or later which contains the necessary security improvements.
3
What versions of Internet Explorer are affected by CVE-2009-2057?
CVE-2009-2057 affects multiple versions of Internet Explorer including 3.0 up to 7.0.
4
Can CVE-2009-2057 lead to data breaches?
Yes, man-in-the-middle attacks exploiting CVE-2009-2057 can lead to unauthorized access to sensitive data.
5
Is there any workaround for CVE-2009-2057 if I cannot upgrade?
While upgrading is the best solution, limiting access to trusted network environments can help mitigate the risk of exploitation.