--- title: "CVE-2009-2061\n | Ubuntu" description: Ubuntu is an open source software operating system that runs from the desktop, to the cloud, to all your internet connected things. url: https://ubuntu.com/security/CVE-2009-2061?format=md keywords: index, follow --- # CVE-2009-2061 Publication date 15 June 2009 Last updated 24 July 2024 --- Ubuntu priority **Low** [Why this priority?](https://ubuntu.com/security/cves/about#priority ) Toggle side navigation ## Description Mozilla Firefox before 3.0.10 processes a 3xx HTTP CONNECT response before a successful SSL handshake, which allows man-in-the-middle attackers to execute arbitrary web script, in an https site's context, by modifying this CONNECT response to specify a 302 redirect to an arbitrary https web site. [Read the notes from the security team](https://ubuntu.com/security/CVE-2009-2061?format=md#notes) ## Status Show unmaintained releases | Package | Ubuntu Release | Status | | --- | --- | --- | | firefox | 11.04 natty | Not affected | | 10.10 maverick | Not affected | | 10.04 LTS lucid | Not affected | | 9.10 karmic | Not in release | | 9.04 jaunty | Not in release | | 8.10 intrepid | Not in release | | 8.04 LTS hardy | Ignored end of life | | 6.06 LTS dapper | Ignored end of life | | kde4libs | 11.04 natty | Not affected | | 10.10 maverick | Not affected | | 10.04 LTS lucid | Not affected | | 9.10 karmic | Not affected | | 9.04 jaunty | Not affected | | 8.10 intrepid | Ignored end of life, was needs-triage | | 8.04 LTS hardy | Ignored end of life | | 6.06 LTS dapper | Not in release | | kdelibs | 11.04 natty | Not affected | | 10.10 maverick | Not affected | | 10.04 LTS lucid | Not affected | | 9.10 karmic | Not affected | | 9.04 jaunty | Not affected | | 8.10 intrepid | Ignored end of life, was needs-triage | | 8.04 LTS hardy | Ignored end of life | | 6.06 LTS dapper | Ignored end of life | | qt4-x11 | 11.04 natty | Not affected | | 10.10 maverick | Not affected | | 10.04 LTS lucid | Not affected | | 9.10 karmic | Not affected | | 9.04 jaunty | Not affected | | 8.10 intrepid | Ignored end of life, was needs-triage | | 8.04 LTS hardy | Not affected | | 6.06 LTS dapper | Not affected | | seamonkey | 11.04 natty | Fixed 1.1.17+nobinonly-0ubuntu1 | | 10.10 maverick | Fixed 1.1.17+nobinonly-0ubuntu1 | | 10.04 LTS lucid | Fixed 1.1.17+nobinonly-0ubuntu1 | | 9.10 karmic | Fixed 1.1.17+nobinonly-0ubuntu1 | | 9.04 jaunty | Fixed 1.1.17+nobinonly-0ubuntu0.9.04.1 | | 8.10 intrepid | Fixed 1.1.17+nobinonly-0ubuntu0.8.10.1 | | 8.04 LTS hardy | Fixed 1.1.17+nobinonly-0ubuntu0.8.04.1 | | 6.06 LTS dapper | Not in release | | webkit | 11.04 natty | Not affected | | 10.10 maverick | Not affected | | 10.04 LTS lucid | Not affected | | 9.10 karmic | Not affected | | 9.04 jaunty | Not affected | | 8.10 intrepid | Ignored end of life, was needs-triage | | 8.04 LTS hardy | Ignored end of life | | 6.06 LTS dapper | Not in release | | xulrunner-1.9 | 11.04 natty | Not in release | | 10.10 maverick | Not in release | | 10.04 LTS lucid | Not in release | | 9.10 karmic | Not in release | | 9.04 jaunty | Fixed 1.9.0.11+build2+nobinonly-0ubuntu0.9.04.1 | | 8.10 intrepid | Fixed 1.9.0.11+build2+nobinonly-0ubuntu0.8.10.2 | | 8.04 LTS hardy | Fixed 1.9.0.11+build2+nobinonly-0ubuntu0.8.04.1 | | 6.06 LTS dapper | Not in release | | xulrunner-1.9.1 | 11.04 natty | Not in release | | 10.10 maverick | Not in release | | 10.04 LTS lucid | Not in release | | 9.10 karmic | Fixed 1.9.1~rc2+nobinonly-0ubuntu1 | | 9.04 jaunty | Fixed 1.9.1+nobinonly-0ubuntu0.9.04.1 | | 8.10 intrepid | Not in release | | 8.04 LTS hardy | Not in release | | 6.06 LTS dapper | Not in release | --- * [How can I get the fixes?](https://ubuntu.com/security/cves/about#security) * [What do statuses mean?](https://ubuntu.com/security/cves/about#statuses) ## Notes --- ### [jdstrand](https://launchpad.net/~jdstrand) https://www.paypal.com/ is the PoC site, but https://wiki.ubuntu.com seems to be a valid trigger as well (both set a cookie which is sent on connect). https://www.verisign.com will trigger the alert() in the PoC, but doesn't contain the cookie firefox-3.0 (3.0.9) is confirmed to be affected mozilla is silently fixing this in 3.0.10, but it won't be public until the CRD konqueror 3 (kdelibs) in dapper is confirmed to be affected konqueror 4 (kde4libs) in jaunty does not seem to be affected (displays it's own connection refused message for all 4xx codes) webkit on jaunty does not seem affected, though all of its consumers are rather flaky (midori, python-webkit/webbrowser.py, webkit/GtkLauncher, kazehakase-webkit). None of these would work with paypal or wiki.u.c, but would with https://www.verisign.com/. At verisign, firefox would display the PoC alert, but without the cookie. webkit, midori and python-webkit would not display the alert at all (kazehakase crashes on any page load). Other consumers are devhelp and anjuta, but I didn't see how to get an external page to load. At any rate, webkit is a tentative 'not-affected'. Will get more feedback from Debian maintainer. qt4-x11 in jaunty does not seem to be affected. arora is its browser consumer and it displays its own 'HTTP request failed' message for all 4xx codes also checked epiphany-webkit on 8.10. The browser can go to paypal, but is not vulnerable (does not display the alert at all for all 4xx codes) ## References * [MITRE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2061) * [NVD](https://nvd.nist.gov/vuln/detail/CVE-2009-2061) * [Launchpad](https://launchpad.net/bugs/cve/CVE-2009-2061) * [Debian](https://security-tracker.debian.org/tracker/CVE-2009-2061) ### Other references *