Cookie Modification Vulnerability in Android Browser
CVE-2008-7298

Currently unrated

Key Information:

Vendor
Google
Status
Android
Android Browser
Vendor
CVE Published:
9 August 2011

Summary

The Android browser lacks adequate restrictions on cookie modifications within HTTPS sessions. This insufficiency allows man-in-the-middle attackers to overwrite or delete cookies using a Set-Cookie header in HTTP responses. The vulnerability stems from missing implementation of the HTTP Strict Transport Security (HSTS) feature to include subdomains, leading to potential unauthorized cookie changes during user sessions.

References

http://michael-coates.blogspot.com/2010/01/cookie-forcing...
x_refsource_MISC
http://code.google.com/p/browsersec/wiki/Part2#Same-origi...
x_refsource_MISC
http://scarybeastsecurity.blogspot.com/2011/02/some-less-...
x_refsource_MISC

Timeline

  • Vulnerability Reserved

  • Vulnerability published

.