3.3 - CVE-2009-0358

Executive Summary

Informations
Name	CVE-2009-0358	First vendor Publication	2009-02-04
Vendor	Cve	Last vendor Modification	2017-09-29

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score	NA
Base Score	NA	Environmental Score	NA
impact SubScore	NA	Temporal Score	NA
Exploitabality Sub Score	NA

Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:A/AC:L/Au:N/C:P/I:N/A:N)
Cvss Base Score	3.3	Attack Range	Adjacent network
Cvss Impact Score	2.9	Attack Complexity	Low
Cvss Expoit Score	6.5	Authentication	None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Mozilla Firefox 3.x before 3.0.6 does not properly implement the (1) no-store and (2) no-cache Cache-Control directives, which allows local users to obtain sensitive information by using the (a) back button or (b) history list of the victim's browser, as demonstrated by reading the response page of an https POST request.

Original Source

Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0358

CWE : Common Weakness Enumeration

%	Id	Name
100 %	CWE-200	Information Exposure

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:10610

Oval ID:	oval:org.mitre.oval:def:10610
Title:	Mozilla Firefox 3.x before 3.0.6 does not properly implement the (1) no-store and (2) no-cache Cache-Control directives, which allows local users to obtain sensitive information by using the (a) back button or (b) history list of the victim's browser, as demonstrated by reading the response page of an https POST request.
Description:	Mozilla Firefox 3.x before 3.0.6 does not properly implement the (1) no-store and (2) no-cache Cache-Control directives, which allows local users to obtain sensitive information by using the (a) back button or (b) history list of the victim's browser, as demonstrated by reading the response page of an https POST request.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2009-0358	Version:	5
Platform(s):	Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5	Product(s):
Definition Synopsis:
OS Section: RHEL4, CentOS4, Oracle Linux 4 RHEL4, CentOS4 or Oracle Linux 4 The operating system installed on the system is Red Hat Enterprise Linux 4 AND CentOS Linux 4.x AND Oracle Linux 4.x AND Configuration section nss-devel is earlier than 0:3.12.2.0-3.el4 AND firefox is earlier than 0:3.0.6-1.el4 AND nss is earlier than 0:3.12.2.0-3.el4 AND nss-tools is earlier than 0:3.12.2.0-3.el4 OR OS Section: RHEL5, CentOS5, Oracle Linux 5 RHEL5, CentOS5 or Oracle Linux 5 The operating system installed on the system is Red Hat Enterprise Linux 5 AND CentOS Linux 5.x AND Oracle Linux 5.x AND Configuration section nss-pkcs11-devel is earlier than 0:3.12.2.0-4.el5 AND xulrunner-devel is earlier than 0:1.9.0.6-1.el5 AND nss is earlier than 0:3.12.2.0-4.el5 AND xulrunner is earlier than 0:1.9.0.6-1.el5 AND xulrunner-devel-unstable is earlier than 0:1.9.0.6-1.el5 AND firefox is earlier than 0:3.0.6-1.el5 AND nss-devel is earlier than 0:3.12.2.0-4.el5 AND nss-tools is earlier than 0:3.12.2.0-4.el5

Definition Id: oval:org.mitre.oval:def:13810

Oval ID:	oval:org.mitre.oval:def:13810
Title:	USN-717-1 -- firefox-3.0, xulrunner-1.9 vulnerabilities
Description:	Several flaws were discovered in the browser engine. These problems could allow an attacker to crash the browser and possibly execute arbitrary code with user privileges. A flaw was discovered in the JavaScript engine. An attacker could bypass the same-origin policy in Firefox by utilizing a chrome XBL method and execute arbitrary JavaScript within the context of another website. A flaw was discovered in the browser engine when restoring closed tabs. If a user were tricked into restoring a tab to a malicious website with form input controls, an attacker could steal local files on the user�s system. Wladimir Palant discovered that Firefox did not restrict access to cookies in HTTP response headers. If a user were tricked into opening a malicious web page, a remote attacker could view sensitive information. Paul Nel discovered that Firefox did not honor certain Cache-Control HTTP directives. A local attacker could exploit this to view private data in improperly cached pages of another user
Family:	unix	Class:	patch
Reference(s):	USN-717-1 CVE-2009-0352 CVE-2009-0353 CVE-2009-0354 CVE-2009-0355 CVE-2009-0357 CVE-2009-0358	Version:	5
Platform(s):	Ubuntu 8.10 Ubuntu 8.04	Product(s):	firefox-3.0 xulrunner-1.9
Definition Synopsis:
Release section Ubuntu 8.10 is installed AND Architecture section Architecture independent section Installed architecture is all AND Packages section abrowser DPKG is earlier than 3.0.6+nobinonly-0ubuntu0.8.10.1 AND firefox DPKG is earlier than 3.0.6+nobinonly-0ubuntu0.8.10.1 AND firefox-granparadiso-dev DPKG is earlier than 3.0.6+nobinonly-0ubuntu0.8.10.1 AND firefox-granparadiso-dom-inspector DPKG is earlier than 3.0.6+nobinonly-0ubuntu0.8.10.1 AND firefox-gnome-support DPKG is earlier than 3.0.6+nobinonly-0ubuntu0.8.10.1 AND firefox-dev DPKG is earlier than 3.0.6+nobinonly-0ubuntu0.8.10.1 AND firefox-granparadiso DPKG is earlier than 3.0.6+nobinonly-0ubuntu0.8.10.1 AND firefox-trunk-gnome-support DPKG is earlier than 3.0.6+nobinonly-0ubuntu0.8.10.1 AND firefox-trunk-dom-inspector DPKG is earlier than 3.0.6+nobinonly-0ubuntu0.8.10.1 AND xulrunner-1.9-venkman DPKG is earlier than 1.9.0.6+nobinonly-0ubuntu0.8.10.1 AND firefox-granparadiso-gnome-support DPKG is earlier than 3.0.6+nobinonly-0ubuntu0.8.10.1 AND firefox-trunk-venkman DPKG is earlier than 3.0.6+nobinonly-0ubuntu0.8.10.1 AND firefox-3.0-dom-inspector DPKG is earlier than 3.0.6+nobinonly-0ubuntu0.8.10.1 AND xulrunner-1.9-dom-inspector DPKG is earlier than 1.9.0.6+nobinonly-0ubuntu0.8.10.1 AND firefox-trunk DPKG is earlier than 3.0.6+nobinonly-0ubuntu0.8.10.1 AND firefox-3.0-venkman DPKG is earlier than 3.0.6+nobinonly-0ubuntu0.8.10.1 AND firefox-libthai DPKG is earlier than 3.0.6+nobinonly-0ubuntu0.8.10.1 AND firefox-trunk-dev DPKG is earlier than 3.0.6+nobinonly-0ubuntu0.8.10.1 AND firefox-dom-inspector DPKG is earlier than 3.0.6+nobinonly-0ubuntu0.8.10.1 OR Architecture depended section Supported architectures section Installed architecture is amd64 AND Installed architecture is i386 AND Installed architecture is powerpc AND Installed architecture is sparc AND Installed architecture is lpia AND Packages section firefox-3.0 DPKG is earlier than 3.0.6+nobinonly-0ubuntu0.8.10.1 AND xulrunner-1.9-dev DPKG is earlier than 1.9.0.6+nobinonly-0ubuntu0.8.10.1 AND firefox-3.0-branding DPKG is earlier than 3.0.6+nobinonly-0ubuntu0.8.10.1 AND xulrunner-1.9-gnome-support DPKG is earlier than 1.9.0.6+nobinonly-0ubuntu0.8.10.1 AND xulrunner-1.9 DPKG is earlier than 1.9.0.6+nobinonly-0ubuntu0.8.10.1 AND firefox-3.0-gnome-support DPKG is earlier than 3.0.6+nobinonly-0ubuntu0.8.10.1 AND abrowser-3.0-branding DPKG is earlier than 3.0.6+nobinonly-0ubuntu0.8.10.1 AND firefox-3.0-dev DPKG is earlier than 3.0.6+nobinonly-0ubuntu0.8.10.1 AND xulrunner-dev DPKG is earlier than 1.9.0.6+nobinonly-0ubuntu0.8.10.1 OR Release section Ubuntu 8.04 is installed AND Architecture section Architecture independent section Installed architecture is all AND Packages section firefox-trunk DPKG is earlier than 3.0.6+nobinonly-0ubuntu0.8.04.1 AND firefox DPKG is earlier than 3.0.6+nobinonly-0ubuntu0.8.04.1 AND firefox-granparadiso-dev DPKG is earlier than 3.0.6+nobinonly-0ubuntu0.8.04.1 AND firefox-granparadiso-dom-inspector DPKG is earlier than 3.0.6+nobinonly-0ubuntu0.8.04.1 AND firefox-gnome-support DPKG is earlier than 3.0.6+nobinonly-0ubuntu0.8.04.1 AND firefox-dev DPKG is earlier than 3.0.6+nobinonly-0ubuntu0.8.04.1 AND firefox-granparadiso DPKG is earlier than 3.0.6+nobinonly-0ubuntu0.8.04.1 AND firefox-trunk-gnome-support DPKG is earlier than 3.0.6+nobinonly-0ubuntu0.8.04.1 AND firefox-trunk-dom-inspector DPKG is earlier than 3.0.6+nobinonly-0ubuntu0.8.04.1 AND xulrunner-1.9-venkman DPKG is earlier than 1.9.0.6+nobinonly-0ubuntu0.8.04.1 AND firefox-granparadiso-gnome-support DPKG is earlier than 3.0.6+nobinonly-0ubuntu0.8.04.1 AND firefox-trunk-venkman DPKG is earlier than 3.0.6+nobinonly-0ubuntu0.8.04.1 AND firefox-3.0-dom-inspector DPKG is earlier than 3.0.6+nobinonly-0ubuntu0.8.04.1 AND xulrunner-1.9-dom-inspector DPKG is earlier than 1.9.0.6+nobinonly-0ubuntu0.8.04.1 AND firefox-3.0-venkman DPKG is earlier than 3.0.6+nobinonly-0ubuntu0.8.04.1 AND firefox-libthai DPKG is earlier than 3.0.6+nobinonly-0ubuntu0.8.04.1 AND firefox-trunk-dev DPKG is earlier than 3.0.6+nobinonly-0ubuntu0.8.04.1 AND firefox-dom-inspector DPKG is earlier than 3.0.6+nobinonly-0ubuntu0.8.04.1 OR Architecture depended section Supported architectures section Installed architecture is powerpc AND Installed architecture is amd64 AND Installed architecture is lpia AND Installed architecture is i386 AND Packages section firefox-3.0 DPKG is earlier than 3.0.6+nobinonly-0ubuntu0.8.04.1 AND xulrunner-1.9-dev DPKG is earlier than 1.9.0.6+nobinonly-0ubuntu0.8.04.1 AND xulrunner-1.9-gnome-support DPKG is earlier than 1.9.0.6+nobinonly-0ubuntu0.8.04.1 AND xulrunner-1.9 DPKG is earlier than 1.9.0.6+nobinonly-0ubuntu0.8.04.1 AND firefox-3.0-gnome-support DPKG is earlier than 3.0.6+nobinonly-0ubuntu0.8.04.1 AND firefox-3.0-dev DPKG is earlier than 3.0.6+nobinonly-0ubuntu0.8.04.1

Definition Id: oval:org.mitre.oval:def:22773

Oval ID:	oval:org.mitre.oval:def:22773
Title:	ELSA-2009:0256: firefox security update (Critical)
Description:	Mozilla Firefox 3.x before 3.0.6 does not properly implement the (1) no-store and (2) no-cache Cache-Control directives, which allows local users to obtain sensitive information by using the (a) back button or (b) history list of the victim's browser, as demonstrated by reading the response page of an https POST request.
Family:	unix	Class:	patch
Reference(s):	ELSA-2009:0256-01 CVE-2009-0352 CVE-2009-0353 CVE-2009-0354 CVE-2009-0355 CVE-2009-0356 CVE-2009-0357 CVE-2009-0358	Version:	33
Platform(s):	Oracle Linux 5	Product(s):	firefox nss xulrunner
Definition Synopsis:
Oracle Linux 5.x rpm test xulrunner-devel-unstable is earlier than 0:1.9.0.6-1.el5 AND xulrunner is earlier than 0:1.9.0.6-1.el5 AND xulrunner-devel is earlier than 0:1.9.0.6-1.el5 AND firefox is earlier than 0:3.0.6-1.el5 AND nss is earlier than 0:3.12.2.0-4.el5 AND nss-tools is earlier than 0:3.12.2.0-4.el5 AND nss-devel is earlier than 0:3.12.2.0-4.el5 AND nss-pkcs11-devel is earlier than 0:3.12.2.0-4.el5

Definition Id: oval:org.mitre.oval:def:29045

Oval ID:	oval:org.mitre.oval:def:29045
Title:	RHSA-2009:0256 -- firefox security update (Critical)
Description:	All Firefox users should upgrade to these updated packages, which contain Firefox version 3.0.6, which corrects these issues. After installing the update, Firefox must be restarted for the changes to take effect.
Family:	unix	Class:	patch
Reference(s):	RHSA-2009:0256 CESA-2009:0256-CentOS 5 CVE-2009-0352 CVE-2009-0353 CVE-2009-0354 CVE-2009-0355 CVE-2009-0356 CVE-2009-0357 CVE-2009-0358	Version:	3
Platform(s):	Red Hat Enterprise Linux 5 Red Hat Enterprise Linux 4 CentOS Linux 5	Product(s):	firefox nss xulrunner
Definition Synopsis:
Red Hat Enterprise Linux 5 release section The operating system installed on the system is Red Hat Enterprise Linux 5 Packages match section nss-devel is earlier than 0:3.12.2.0-4.el5 AND nss-pkcs11-devel is earlier than 0:3.12.2.0-4.el5 AND xulrunner-devel is earlier than 0:1.9.0.6-1.el5 AND xulrunner-devel-unstable is earlier than 0:1.9.0.6-1.el5 AND firefox is earlier than 0:3.0.6-1.el5 AND nss is earlier than 0:3.12.2.0-4.el5 AND nss-tools is earlier than 0:3.12.2.0-4.el5 AND xulrunner is earlier than 0:1.9.0.6-1.el5 AND Red Hat Enterprise Linux 4 release section The operating system installed on the system is Red Hat Enterprise Linux 4 Packages match section firefox is earlier than 0:3.0.6-1.el4 AND nss is earlier than 0:3.12.2.0-3.el4 AND nss-devel is earlier than 0:3.12.2.0-3.el4 AND nss-tools is earlier than 0:3.12.2.0-3.el4

CPE : Common Platform Enumeration

Type	Description	Count
Application	Mozilla Firefox cpe:2.3:a:mozilla:firefox:3.0.5:::::::* cpe:2.3:a:mozilla:firefox:3.0.4:::::::* cpe:2.3:a:mozilla:firefox:3.0.3:::::::* cpe:2.3:a:mozilla:firefox:3.0.2:::::::* cpe:2.3:a:mozilla:firefox:3.0.1:::::::* cpe:2.3:a:mozilla:firefox:3.0:-:::::: cpe:2.3:a:mozilla:firefox:3.0:alpha:::::: cpe:2.3:a:mozilla:firefox:3.0:beta5:::::: cpe:2.3:a:mozilla:firefox:3.0:beta2::::::	9

OpenVAS Exploits

Date	Description
2011-08-09	Name : CentOS Update for firefox CESA-2009:0256 centos4 i386 File : nvt/gb_CESA-2009_0256_firefox_centos4_i386.nasl
2011-08-09	Name : CentOS Update for firefox CESA-2009:0256 centos5 i386 File : nvt/gb_CESA-2009_0256_firefox_centos5_i386.nasl
2009-06-05	Name : Ubuntu USN-723-1 (git-core) File : nvt/ubuntu_723_1.nasl
2009-02-23	Name : Mandrake Security Advisory MDVSA-2009:044 (firefox) File : nvt/mdksa_2009_044.nasl
2009-02-20	Name : Mozilla Firefox Multiple Vulnerabilities Feb-09 (Linux) File : nvt/secpod_firefox_mult_vuln_feb09_lin.nasl
2009-02-20	Name : Mozilla Firefox Multiple Vulnerabilities Feb-09 (Win) File : nvt/secpod_firefox_mult_vuln_feb09_win.nasl
2009-02-18	Name : SuSE Security Advisory SUSE-SA:2009:009 (MozillaFirefox) File : nvt/suse_sa_2009_009.nasl
2009-02-13	Name : Fedora Core 10 FEDORA-2009-1398 (xulrunner) File : nvt/fcore_2009_1398.nasl
2009-02-13	Name : Fedora Core 9 FEDORA-2009-1399 (xulrunner) File : nvt/fcore_2009_1399.nasl
2009-02-13	Name : FreeBSD Ports: firefox File : nvt/freebsd_firefox37.nasl
2009-02-13	Name : Ubuntu USN-717-1 (xulrunner-1.9) File : nvt/ubuntu_717_1.nasl
2009-02-10	Name : RedHat Security Advisory RHSA-2009:0256 File : nvt/RHSA_2009_0256.nasl
2009-02-10	Name : CentOS Security Advisory CESA-2009:0256 (firefox) File : nvt/ovcesa2009_0256.nasl

Open Source Vulnerability Database (OSVDB)

Id	Description
51925	Mozilla Firefox Multiple Cache-Control Directives Local Information Disclosure

Nessus® Vulnerability Scanner

Date	Description
2013-07-12	Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2009-0256.nasl - Type : ACT_GATHER_INFO
2013-01-08	Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-201301-01.nasl - Type : ACT_GATHER_INFO
2012-08-01	Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20090204_firefox_on_SL4_x.nasl - Type : ACT_GATHER_INFO
2009-07-21	Name : The remote openSUSE host is missing a security update. File : suse_11_0_MozillaFirefox-090206.nasl - Type : ACT_GATHER_INFO
2009-07-21	Name : The remote openSUSE host is missing a security update. File : suse_11_1_MozillaFirefox-090206.nasl - Type : ACT_GATHER_INFO
2009-04-23	Name : The remote Fedora host is missing one or more security updates. File : fedora_2009-1398.nasl - Type : ACT_GATHER_INFO
2009-04-23	Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2009-044.nasl - Type : ACT_GATHER_INFO
2009-04-23	Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-717-1.nasl - Type : ACT_GATHER_INFO
2009-02-12	Name : The remote FreeBSD host is missing one or more security-related updates. File : freebsd_pkg_8b491182f84211dd94d90030843d3802.nasl - Type : ACT_GATHER_INFO
2009-02-06	Name : The remote Fedora host is missing one or more security updates. File : fedora_2009-1399.nasl - Type : ACT_GATHER_INFO
2009-02-05	Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2009-0256.nasl - Type : ACT_GATHER_INFO
2009-02-04	Name : The remote Windows host contains a web browser that is affected by multiple v... File : mozilla_firefox_306.nasl - Type : ACT_GATHER_INFO
2009-02-04	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2009-0256.nasl - Type : ACT_GATHER_INFO

Sources (Detail)

Source	Url
BID	http://www.securityfocus.com/bid/33598
CONFIRM	http://support.avaya.com/elmodocs2/security/ASA-2009-040.htm http://www.mozilla.org/security/announce/2009/mfsa2009-06.html https://bugzilla.mozilla.org/show_bug.cgi?id=441751
FEDORA	https://www.redhat.com/archives/fedora-package-announce/2009-February/msg0024...
MANDRIVA	http://www.mandriva.com/security/advisories?name=MDVSA-2009:044
MISC	http://blogs.imeta.co.uk/JDeabill/archive/2008/07/14/303.aspx
OVAL	https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.ova...
REDHAT	http://rhn.redhat.com/errata/RHSA-2009-0256.html
SECTRACK	http://www.securitytracker.com/id?1021667
SECUNIA	http://secunia.com/advisories/33799 http://secunia.com/advisories/33809 http://secunia.com/advisories/33831 http://secunia.com/advisories/33841 http://secunia.com/advisories/33846 http://secunia.com/advisories/33869
SUSE	http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00001.html
UBUNTU	http://www.ubuntu.com/usn/usn-717-1
VUPEN	http://www.vupen.com/english/advisories/2009/0313

Alert History

If you want to see full details history, please login or register.

Date	Informations
2024-02-02 01:10:31	Multiple Updates
2024-02-01 12:02:58	Multiple Updates
2023-09-05 12:09:50	Multiple Updates
2023-09-05 01:02:49	Multiple Updates
2023-09-02 12:09:56	Multiple Updates
2023-09-02 01:02:51	Multiple Updates
2023-08-12 12:11:36	Multiple Updates
2023-08-12 01:02:50	Multiple Updates
2023-08-11 12:09:57	Multiple Updates
2023-08-11 01:02:56	Multiple Updates
2023-08-06 12:09:34	Multiple Updates
2023-08-06 01:02:52	Multiple Updates
2023-08-04 12:09:39	Multiple Updates
2023-08-04 01:02:54	Multiple Updates
2023-07-14 12:09:37	Multiple Updates
2023-07-14 01:02:52	Multiple Updates
2023-03-29 01:11:04	Multiple Updates
2023-03-28 12:02:58	Multiple Updates
2022-10-11 12:08:33	Multiple Updates
2022-10-11 01:02:41	Multiple Updates
2021-05-04 12:09:05	Multiple Updates
2021-04-22 01:09:26	Multiple Updates
2020-05-23 00:23:17	Multiple Updates
2017-09-29 09:24:03	Multiple Updates
2016-04-26 18:35:53	Multiple Updates
2014-02-17 10:48:37	Multiple Updates
2013-05-10 23:43:17	Multiple Updates

Global Informations

Type	Count
CWE ID(s)	1
Oval ID(s)	4
CPE ID(s)	9
Sources(s)	19
osvdb(s)	1
Openvas Exploit(s)	13
Nessus® Exploit(s)	13

	Related
10	USN-717-1
10	RHSA-2009:0256
10	MDVSA-2009:044
10	GLSA-201301-01
Info : listing not affected by your CVSS Env Score

Same Subject	Severity
Login to view 4 more Alert(s)

3.3 - CVE-2009-0358

Executive Summary

Security-Database Scoring CVSS v3

Security-Database Scoring CVSS v2

Detail

Original Source

CWE : Common Weakness Enumeration

OVAL Definitions

CPE : Common Platform Enumeration

OpenVAS Exploits

Open Source Vulnerability Database (OSVDB)

Nessus® Vulnerability Scanner

Sources (Detail)

Alert History

Global Informations

Open Standards

Other Databases

COMPANY

STANDARDS

RECENT POSTS

MENU