[Secure-testing-team] Bug#542926: CVE-2009-2474: Improper verification of x590v3 certificate with NUL (zero) byte in certain fields
Giuseppe Iuculano
giuseppe at iuculano.it
Sat Aug 22 09:34:28 UTC 2009
Package: neon27,neon26,neon
Severity: grave
Tags: security
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Hi,
the following CVE (Common Vulnerabilities & Exposures) id was
published for neon.
CVE-2009-2474[0]:
neon before 0.28.6, when OpenSSL is used, does not properly handle a
'\0' character in a domain name in the subject's Common Name (CN)
field of an X.509 certificate, which allows man-in-the-middle
attackers to spoof arbitrary SSL servers via a crafted certificate
issued by a legitimate Certification Authority, a related issue to
CVE-2009-2408.
If you fix the vulnerability please also make sure to include the
CVE id in your changelog entry.
For further information see:
[0] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2474
http://security-tracker.debian.net/tracker/CVE-2009-2474
http://lists.manyfish.co.uk/pipermail/neon/2009-August/001046.html
http://lists.manyfish.co.uk/pipermail/neon/2009-August/001044.html
Cheers,
Giuseppe
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
iEYEARECAAYFAkqPu6EACgkQNxpp46476apIvQCgh/SR333ms4qiHyQOSzs4+8A5
i64AoJXZOzUPPtetame4R2EI7j7dYVhO
=vUEk
-----END PGP SIGNATURE-----
More information about the Secure-testing-team
mailing list