Apple Safari before 3.2.2 processes a 3xx HTTP CONNECT response before a successful SSL handshake, which allows man-in-the-middle attackers to execute arbitrary web script, in an https site's context, by modifying this CONNECT response to specify a 302 redirect to an arbitrary https web site.

The version of Safari installed on the remote Windows host is earlier than 3.2.2.  Such versions reportedly have multiple vulnerabilities : 

  - Multiple input validation issues in their handling of 'feed: ' URLs, which could be abused to execute arbitrary JavaScript code in the local security zone. (CVE-2009-0137)

  - A cached certificate is not required before displaying a lock icon for a HTTPS web site. This allows a man-in-the-middle attacker to present the user with spoofed web pages over HTTPS that appear to be from a legitimate source. (CVE-2009-2072)

  - The browser processes a 3xxx HTTP CONNECT before a successful SSL handshake, which could allow a man-in-the-midddle attacker to execute arbitrary script code in the context of a HTTPS site. (CVE-2009-2062)

The version of Safari installed on the remote Windows host is earlier than 3.2.2.  Such versions reportedly have multiple security vulnerabilities :

  - Input validation issues in their handling of 'feed:'     URLs, which could be abused to execute arbitrary     JavaScript code in the local security zone.

  - A cached certificate is not required before displaying     a lock icon for a HTTPS website.  This allows a man-     in-the-middle attacker to present the user with spoofed     web pages over HTTPS that appear to be from a legitimate     source.

  - The browser processes a 3xx HTTP CONNECT before a     successful SSL handshake, which could allow a man-in-     the-middle attacker to execute arbitrary script code in     the context of a HTTPS site.

 The version of Opera installed on the remote host reportedly is affected by several issues : 

 - An issue where TLS certificates could be used to execute arbitrary code.

 - The browser processes a 3xx HTTP CONNECT response before a successful SSL handshake, which could allow a man-in-the-middle attacker to execute arbitrary web script in the context of a HTTPS server.

ID	Name	Product	Family	Severity
4932	Safari < 3.2.2 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	high
35687	Safari < 3.2.2 Multiple Vulnerabilities	Nessus	Windows	high
4323	Opera < 9.25 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	medium

Detections

Analytics

CVE-2009-2062

medium

Tenable Plugins

high

high

medium