CVE-2009-3983: Medium severity mozilla seamonkey vulnerability
Mozilla Firefox before 3.0.16 and 3.5.x before 3.5.6, and SeaMonkey before 2.0.1, allows remote attackers to send authenticated requests to arbitrary applications by replaying the NTLM credentials of a browser user.
Other sources
Security researcher Takehiro Takahashi of the IBM X-Force reported that Mozilla's NTLM implementation was vulnerable to reflection attacks in which NTLM credentials from one application could be forwarded to another arbitary application via the browser. If an attacker could get a user to visit a web page he controlled he could force NTLM authenticated requests to be forwarded to another application on behalf of the user.
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2009-3983?
CVE-2009-3983 has a moderate severity level as it allows remote attackers to replay NTLM credentials.
How do I fix CVE-2009-3983?
To fix CVE-2009-3983, upgrade Mozilla Firefox to version 3.0.16 or later, or update to SeaMonkey 2.0.1 or newer.
Which versions are affected by CVE-2009-3983?
CVE-2009-3983 affects Mozilla Firefox versions earlier than 3.0.16, 3.5.x versions prior to 3.5.6, and SeaMonkey versions before 2.0.1.
What are the potential impacts of CVE-2009-3983?
The potential impacts of CVE-2009-3983 include unauthorized access to sensitive applications through NTLM credential replay.
Is there a workaround for CVE-2009-3983 while awaiting a patch?
There are no effective workarounds for CVE-2009-3983; upgrading to a secure version is essential.