Microsoft Internet Explorer before 8 uses the HTTP Host header to determine the context of a document provided in a (1) 4xx or (2) 5xx CONNECT response from a proxy server, which allows man-in-the-middle attackers to execute arbitrary web script by modifying this CONNECT response, aka an SSL tampering attack.
Weakness
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Ie | Microsoft | 5.0-sp1 (including) | 5.0-sp1 (including) |
| Ie | Microsoft | 5.0-sp4 (including) | 5.0-sp4 (including) |
| Ie | Microsoft | 5.22 (including) | 5.22 (including) |
| Ie | Microsoft | 6.0-sp1 (including) | 6.0-sp1 (including) |
| Ie | Microsoft | 6.0-sp2 (including) | 6.0-sp2 (including) |
| Internet_explorer | Microsoft | 3.0 (including) | 3.0 (including) |
| Internet_explorer | Microsoft | 3.0.1 (including) | 3.0.1 (including) |
| Internet_explorer | Microsoft | 3.0.2 (including) | 3.0.2 (including) |
| Internet_explorer | Microsoft | 3.1 (including) | 3.1 (including) |
| Internet_explorer | Microsoft | 3.2 (including) | 3.2 (including) |
| Internet_explorer | Microsoft | 4.0 (including) | 4.0 (including) |
| Internet_explorer | Microsoft | 4.0.1 (including) | 4.0.1 (including) |
| Internet_explorer | Microsoft | 4.0.1-sp1 (including) | 4.0.1-sp1 (including) |
| Internet_explorer | Microsoft | 4.0.1-sp2 (including) | 4.0.1-sp2 (including) |
| Internet_explorer | Microsoft | 4.01 (including) | 4.01 (including) |
| Internet_explorer | Microsoft | 4.1 (including) | 4.1 (including) |
| Internet_explorer | Microsoft | 4.01-sp1 (including) | 4.01-sp1 (including) |
| Internet_explorer | Microsoft | 4.5 (including) | 4.5 (including) |
| Internet_explorer | Microsoft | 4.40.308 (including) | 4.40.308 (including) |
| Internet_explorer | Microsoft | 4.40.520 (including) | 4.40.520 (including) |
| Internet_explorer | Microsoft | 4.70.1155 (including) | 4.70.1155 (including) |
| Internet_explorer | Microsoft | 4.70.1158 (including) | 4.70.1158 (including) |
| Internet_explorer | Microsoft | 4.70.1215 (including) | 4.70.1215 (including) |
| Internet_explorer | Microsoft | 4.70.1300 (including) | 4.70.1300 (including) |
| Internet_explorer | Microsoft | 4.71.544 (including) | 4.71.544 (including) |
| Internet_explorer | Microsoft | 4.71.1008.3 (including) | 4.71.1008.3 (including) |
| Internet_explorer | Microsoft | 4.71.1712.6 (including) | 4.71.1712.6 (including) |
| Internet_explorer | Microsoft | 4.72.2106.8 (including) | 4.72.2106.8 (including) |
| Internet_explorer | Microsoft | 4.72.3110.8 (including) | 4.72.3110.8 (including) |
| Internet_explorer | Microsoft | 4.72.3612.1713 (including) | 4.72.3612.1713 (including) |
| Internet_explorer | Microsoft | 5 (including) | 5 (including) |
| Internet_explorer | Microsoft | 5.0 (including) | 5.0 (including) |
| Internet_explorer | Microsoft | 5.0.1 (including) | 5.0.1 (including) |
| Internet_explorer | Microsoft | 5.0.1-sp1 (including) | 5.0.1-sp1 (including) |
| Internet_explorer | Microsoft | 5.0.1-sp2 (including) | 5.0.1-sp2 (including) |
| Internet_explorer | Microsoft | 5.0.1-sp3 (including) | 5.0.1-sp3 (including) |
| Internet_explorer | Microsoft | 5.0.1-sp4 (including) | 5.0.1-sp4 (including) |
| Internet_explorer | Microsoft | 5.00.0518.10 (including) | 5.00.0518.10 (including) |
| Internet_explorer | Microsoft | 5.00.0910.1309 (including) | 5.00.0910.1309 (including) |
| Internet_explorer | Microsoft | 5.00.2014.0216 (including) | 5.00.2014.0216 (including) |
| Internet_explorer | Microsoft | 5.00.2314.1003 (including) | 5.00.2314.1003 (including) |
| Internet_explorer | Microsoft | 5.00.2614.3500 (including) | 5.00.2614.3500 (including) |
| Internet_explorer | Microsoft | 5.00.2919.800 (including) | 5.00.2919.800 (including) |
| Internet_explorer | Microsoft | 5.00.2919.3800 (including) | 5.00.2919.3800 (including) |
| Internet_explorer | Microsoft | 5.00.2919.6307 (including) | 5.00.2919.6307 (including) |
| Internet_explorer | Microsoft | 5.00.2920.0000 (including) | 5.00.2920.0000 (including) |
| Internet_explorer | Microsoft | 5.00.3103.1000 (including) | 5.00.3103.1000 (including) |
| Internet_explorer | Microsoft | 5.00.3105.0106 (including) | 5.00.3105.0106 (including) |
| Internet_explorer | Microsoft | 5.00.3314.2101 (including) | 5.00.3314.2101 (including) |
| Internet_explorer | Microsoft | 5.00.3315.1000 (including) | 5.00.3315.1000 (including) |
| Internet_explorer | Microsoft | 5.00.3502.1000 (including) | 5.00.3502.1000 (including) |
| Internet_explorer | Microsoft | 5.00.3700.1000 (including) | 5.00.3700.1000 (including) |
| Internet_explorer | Microsoft | 5.01 (including) | 5.01 (including) |
| Internet_explorer | Microsoft | 5.1 (including) | 5.1 (including) |
| Internet_explorer | Microsoft | 5.01-sp1 (including) | 5.01-sp1 (including) |
| Internet_explorer | Microsoft | 5.01-sp2 (including) | 5.01-sp2 (including) |
| Internet_explorer | Microsoft | 5.01-sp3 (including) | 5.01-sp3 (including) |
| Internet_explorer | Microsoft | 5.01-sp4 (including) | 5.01-sp4 (including) |
| Internet_explorer | Microsoft | 5.2.3 (including) | 5.2.3 (including) |
| Internet_explorer | Microsoft | 5.5 (including) | 5.5 (including) |
| Internet_explorer | Microsoft | 5.5-preview (including) | 5.5-preview (including) |
| Internet_explorer | Microsoft | 5.5-sp1 (including) | 5.5-sp1 (including) |
| Internet_explorer | Microsoft | 5.5-sp2 (including) | 5.5-sp2 (including) |
| Internet_explorer | Microsoft | 5.50.3825.1300 (including) | 5.50.3825.1300 (including) |
| Internet_explorer | Microsoft | 5.50.4030.2400 (including) | 5.50.4030.2400 (including) |
| Internet_explorer | Microsoft | 5.50.4134.0600 (including) | 5.50.4134.0600 (including) |
| Internet_explorer | Microsoft | 5.50.4308.2900 (including) | 5.50.4308.2900 (including) |
| Internet_explorer | Microsoft | 5.50.4522.1800 (including) | 5.50.4522.1800 (including) |
| Internet_explorer | Microsoft | 5.50.4807.2300 (including) | 5.50.4807.2300 (including) |
| Internet_explorer | Microsoft | 6 (including) | 6 (including) |
| Internet_explorer | Microsoft | 6-sp1 (including) | 6-sp1 (including) |
| Internet_explorer | Microsoft | 6.0 (including) | 6.0 (including) |
| Internet_explorer | Microsoft | 6.00.2462.0000 (including) | 6.00.2462.0000 (including) |
| Internet_explorer | Microsoft | 6.00.2479.0006 (including) | 6.00.2479.0006 (including) |
| Internet_explorer | Microsoft | 6.0.2600 (including) | 6.0.2600 (including) |
| Internet_explorer | Microsoft | 6.0.2800 (including) | 6.0.2800 (including) |
| Internet_explorer | Microsoft | 6.0.2800.1106 (including) | 6.0.2800.1106 (including) |
| Internet_explorer | Microsoft | 6.00.2800.1106 (including) | 6.00.2800.1106 (including) |
| Internet_explorer | Microsoft | 6.0.2900 (including) | 6.0.2900 (including) |
| Internet_explorer | Microsoft | 6.0.2900.2180 (including) | 6.0.2900.2180 (including) |
| Internet_explorer | Microsoft | 6.00.2900.2180 (including) | 6.00.2900.2180 (including) |
| Internet_explorer | Microsoft | 6.00.3663.0000 (including) | 6.00.3663.0000 (including) |
| Internet_explorer | Microsoft | 6.00.3790.0000 (including) | 6.00.3790.0000 (including) |
| Internet_explorer | Microsoft | 6.00.3790.1830 (including) | 6.00.3790.1830 (including) |
| Internet_explorer | Microsoft | 6.00.3790.3959 (including) | 6.00.3790.3959 (including) |
| Internet_explorer | Microsoft | 7 (including) | 7 (including) |
| Internet_explorer | Microsoft | 7.0 (including) | 7.0 (including) |
| Internet_explorer | Microsoft | 7.0-beta (including) | 7.0-beta (including) |
| Internet_explorer | Microsoft | 7.0-beta1 (including) | 7.0-beta1 (including) |
| Internet_explorer | Microsoft | 7.0-beta3 (including) | 7.0-beta3 (including) |
| Internet_explorer | Microsoft | 7.0.5730.11 (including) | 7.0.5730.11 (including) |
| Internet_explorer | Microsoft | 7.00.5730.1100 (including) | 7.00.5730.1100 (including) |
| Internet_explorer | Microsoft | 7.00.6000.16386 (including) | 7.00.6000.16386 (including) |
| Internet_explorer | Microsoft | 7.00.6000.16441 (including) | 7.00.6000.16441 (including) |
Potential Mitigations
Related Attack Patterns
- https://cwe.mitre.org/data/definitions/114.html
- https://cwe.mitre.org/data/definitions/115.html
- https://cwe.mitre.org/data/definitions/151.html
- https://cwe.mitre.org/data/definitions/194.html
- https://cwe.mitre.org/data/definitions/22.html
- https://cwe.mitre.org/data/definitions/57.html
- https://cwe.mitre.org/data/definitions/593.html
- https://cwe.mitre.org/data/definitions/633.html
- https://cwe.mitre.org/data/definitions/650.html
- https://cwe.mitre.org/data/definitions/94.html