Уязвимость CVE-2009-2474: Информация

Описание

neon before 0.28.6, when OpenSSL or GnuTLS is used, does not properly handle a '\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.

Важность: MEDIUM (5,8)

URL: https://nvd.nist.gov/vuln/detail/CVE-2009-2474
Опубликовано: 21 августа 2009 г.
Изменено: 22 мая 2020 г.
Идентификатор типа ошибки: CWE-326

Ссылки на рекомендации, решения и инструменты

Ссылка
Ресурс
FEDORA-2009-8815
  • Mailing List
  • Third Party Advisory
[neon] 20090818 neon: release 0.28.6 (SECURITY)
  • Mailing List
  • Third Party Advisory
FEDORA-2009-8794
  • Mailing List
  • Third Party Advisory
36371
  • Third Party Advisory
[neon] 20090818 CVE-2009-2474: fix handling of NUL in SSL cert subject names
  • Mailing List
  • Third Party Advisory
ADV-2009-2341
  • Permissions Required
MDVSA-2009:221
  • Third Party Advisory
36079
  • Third Party Advisory
  • VDB Entry
USN-835-1
  • Third Party Advisory
36799
  • Third Party Advisory
http://support.apple.com/kb/HT4435
  • Broken Link
APPLE-SA-2010-11-10-1
  • Mailing List
  • Third Party Advisory
oval:org.mitre.oval:def:11721
  • Third Party Advisory

    1. Конфигурация 1

      cpe:2.3:a:webdav:neon:*:*:*:*:*:*:*:*
      End excliding
      0.28.6

      Конфигурация 2

      cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*
      End excliding
      10.6.5

      Конфигурация 3

      cpe:2.3:o:canonical:ubuntu_linux:6.06:*:*:*:lts:*:*:*
      cpe:2.3:o:canonical:ubuntu_linux:9.04:*:*:*:*:*:*:*
      cpe:2.3:o:canonical:ubuntu_linux:8.04:*:*:*:lts:*:*:*
      cpe:2.3:o:canonical:ubuntu_linux:8.10:*:*:*:*:*:*:*

      Конфигурация 4

      cpe:2.3:o:fedoraproject:fedora:11:*:*:*:*:*:*:*
      cpe:2.3:o:fedoraproject:fedora:10:*:*:*:*:*:*:*
VKontakte|Telegram|YouTube|Forum|GitHub|Bugzilla
Версия: v24.5.3
Наверх