CVE-2009-2060: Medium severity Google Chrome vulnerability
Published Jun 15, 2009
·Updated
src/net/http/httptransactionwinhttp.cc in Google Chrome before 1.0.154.53 uses the HTTP Host header to determine the context of a document provided in a (1) 4xx or (2) 5xx CONNECT response from a proxy server, which allows man-in-the-middle attackers to execute arbitrary web script by modifying this CONNECT response, aka an "SSL tampering" attack.
Affected Software
16 affected components
Google Chrome=0.3.154.3
Google Chrome=0.2.149.30
Google Chrome=0.4.154.31
Google Chrome=1.0.154.39
Google Chrome=0.4.154.33
Google Chrome=1.0.154.43
Google Chrome=1.0.154.42
Google Chrome=0.4.154.18
Google Chrome=0.2.149.29
Google Chrome=0.2.152.1
Google Chrome=0.3.154.0
Google Chrome=0.2.153.1
Google Chrome=1.0.154.36
Google Chrome=1.0.154.46
Google Chrome=0.4.154.22
Google Chrome<=1.0.154.52
Event History
Jun 15, 2009
CVE Published
via MITRE·07:00 PM
Data Sourced
via MITRE·07:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2009-2060?
CVE-2009-2060 has been classified as a medium severity vulnerability.
2
What versions of Google Chrome are affected by CVE-2009-2060?
CVE-2009-2060 affects Google Chrome versions prior to 1.0.154.53.
3
How do I fix CVE-2009-2060?
To fix CVE-2009-2060, update Google Chrome to version 1.0.154.53 or later.
4
What type of attack does CVE-2009-2060 enable?
CVE-2009-2060 enables man-in-the-middle attackers to execute arbitrary web scripts.
5
Is CVE-2009-2060 related to HTTP Host header manipulation?
Yes, CVE-2009-2060 involves the use of the HTTP Host header to determine document context.