CVE-2008-7298

Currently unrated

Key Information:

Vendor
Google
Status
Android
Android Browser
Vendor
CVE Published:
9 August 2011

Summary

The Android browser in Android cannot properly restrict modifications to cookies established in HTTPS sessions, which allows man-in-the-middle attackers to overwrite or delete arbitrary cookies via a Set-Cookie header in an HTTP response, related to lack of the HTTP Strict Transport Security (HSTS) includeSubDomains feature, aka a "cookie forcing" issue.

References

http://michael-coates.blogspot.com/2010/01/cookie-forcing...
x_refsource_MISC
http://code.google.com/p/browsersec/wiki/Part2#Same-origi...
x_refsource_MISC
http://scarybeastsecurity.blogspot.com/2011/02/some-less-...
x_refsource_MISC

Timeline

  • Vulnerability Reserved

  • Vulnerability published

Collectors

NVD DatabaseMitre Database
.