CVE-2009-0144

CFNetwork in Apple Mac OS X 10.5 before 10.5.7 does not properly parse noncompliant Set-Cookie headers, which allows remote attackers to obtain sensitive information by sniffing the network for "secure cookies" that are sent over unencrypted HTTP connections.

Score

CVSS 2.0 4.3 Medium

Status

Modified - cve@mitre.org

Published

2009-05-13

Last modified

2024-08-07

Weaknesses

CWE-16

Affected products

• Mac Os X (Apple)
• Mac Os X Server (Apple)

References

• http://lists.apple.com/archives/security-announce/2009/May/msg00002.html
• http://secunia.com/advisories/35074
• http://support.apple.com/kb/HT3549
• http://www.securityfocus.com/bid/34926
• http://www.securitytracker.com/id?1022214
• http://www.us-cert.gov/cas/techalerts/TA09-133A.html
• http://www.vupen.com/english/advisories/2009/1297
• https://exchange.xforce.ibmcloud.com/vulnerabilities/50479