Vulnerabilities > CVE-2009-2973 - Cryptographic Issues vulnerability in Google Chrome
Attack vector
UNKNOWN Attack complexity
UNKNOWN Privileges required
UNKNOWN Confidentiality impact
UNKNOWN Integrity impact
UNKNOWN Availability impact
UNKNOWN Summary
Google Chrome before 2.0.172.43 does not prevent SSL connections to a site with an X.509 certificate signed with the (1) MD2 or (2) MD4 algorithm, which makes it easier for man-in-the-middle attackers to spoof arbitrary HTTPS servers via a crafted certificate, a related issue to CVE-2009-2409.
Vulnerable Configurations
Common Weakness Enumeration (CWE)
Common Attack Pattern Enumeration and Classification (CAPEC)
- Signature Spoofing by Key Recreation An attacker obtains an authoritative or reputable signer's private signature key by exploiting a cryptographic weakness in the signature algorithm or pseudorandom number generation and then uses this key to forge signatures from the original signer to mislead a victim into performing actions that benefit the attacker.
References
- http://code.google.com/p/chromium/issues/detail?id=18725
- http://code.google.com/p/chromium/issues/detail?id=18725
- http://googlechromereleases.blogspot.com/2009/08/stable-update-security-fixes.html
- http://googlechromereleases.blogspot.com/2009/08/stable-update-security-fixes.html
- http://secunia.com/advisories/36417
- http://secunia.com/advisories/36417
- http://www.vupen.com/english/advisories/2009/2420
- http://www.vupen.com/english/advisories/2009/2420
- https://exchange.xforce.ibmcloud.com/vulnerabilities/52903
- https://exchange.xforce.ibmcloud.com/vulnerabilities/52903