CVE-2009-2072: Medium severity Safari vulnerability

Q: What is the severity of CVE-2009-2072?

CVE-2009-2072 is considered to have a moderate severity, allowing man-in-the-middle attacks.

Q: How do I fix CVE-2009-2072?

To fix CVE-2009-2072, update your Apple Safari browser to the latest version, which has patched this vulnerability.

Q: Which versions of Apple Safari are affected by CVE-2009-2072?

CVE-2009-2072 affects multiple versions of Apple Safari, including versions from 0.8 to 3.2.1.

Q: What type of attack is possible with CVE-2009-2072?

CVE-2009-2072 allows attackers to spoof HTTPS sites through man-in-the-middle attacks using crafted CONNECT response pages.

Q: Is there a workaround for CVE-2009-2072 if I cannot update Apple Safari?

A temporary workaround for CVE-2009-2072 includes avoiding the use of proxy servers for secure connections until a fix can be applied.

Published Jun 15, 2009

Updated

Apple Safari does not require a cached certificate before displaying a lock icon for an https web site, which allows man-in-the-middle attackers to spoof an arbitrary https site by sending the browser a crafted (1) 4xx or (2) 5xx CONNECT response page for an https request sent through a proxy server.

Affected Software

66 affected components

Safari=3.0.4b

Safari=1.3.0

Safari=1.0.3-85.8

Safari=2.0.3-417.9.3

Safari=1.3.2

Safari=2

Safari=1.1.1

Safari=3.0.4

Safari=1.2.2

Safari=3.0.1-beta

Safari=2.0.1

Safari=2.0.3

Safari=1.0.3

Safari=2.0.2

Safari=1.0.2

Safari=3.0.0

Safari=3.0.1

Safari=3.0.2

Safari=1.0

Safari=2.0.4_419.3

Safari=3.0.3b

Safari=3.1.1

Safari=1.3

Safari=3.1

Safari=2.0.3-417.9

Safari=1.2.5

Safari=2.0.3-417.9.2

Safari=3.2

Safari=3.0.3

Safari=2.0

Safari=1.2.4

Safari=1.0.1

Safari<=3.2.1

Safari=2.0.3-417.8

Safari=3.1.2

Safari=1.2.1

Safari=3.1.0b

Safari=1.0.3-85.8.1

Safari=3.1.0

Safari=1.0-beta

Safari=0.8

Safari=2.0.4

Safari=1.0-beta2

Safari=1.1

Safari=1.3.2-312.5

Safari=3.0.0b

Safari=1.3.1

Safari=2.0.0

Safari=3.2.0

Safari=1.1.0

Safari=3.0.2b

Safari=1.2

Safari=1.2.0

Safari=3.0.1b

Safari=2.0_pre

Safari=1.0.0b1

Safari=3.0

Safari=3.0.4_beta

Safari=3.0.3-522.15.5

Safari=2.0.3_417.9.3

Safari=1.0.0

Safari=1.2.3

Safari=1.3.2-312.6

Safari=3

Safari=1.0.0b2

Safari=0.9

Event History

Jun 15, 2009

CVE Published

via MITRE·07:00 PM

Data Sourced

via MITRE·07:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2009-2072?

CVE-2009-2072 is considered to have a moderate severity, allowing man-in-the-middle attacks.

How do I fix CVE-2009-2072?

To fix CVE-2009-2072, update your Apple Safari browser to the latest version, which has patched this vulnerability.

Which versions of Apple Safari are affected by CVE-2009-2072?