CVE

Id
37486  
CVE No.
CVE-2009-0051  
Status
Candidate  
Description
ZXID 0.29 and earlier does not properly check the return value from the OpenSSL DSA_verify function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature, a similar vulnerability to CVE-2008-5077.  
Phase
Assigned (20090107)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
406529 37486 CVE-2009-0051 BUGTRAQ:20090107 [oCERT-2008-016] Multiple OpenSSL signature verification API misuses  View
406530 37486 CVE-2009-0051 URL:http://www.securityfocus.com/archive/1/archive/1/499827/100/0/threaded  View
406531 37486 CVE-2009-0051 MISC:http://www.ocert.org/advisories/ocert-2008-016.html  View
406532 37486 CVE-2009-0051 XF:openssl-dsa-verify-security-bypass(47837)  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
40676 JVNDB-2009-001682 Cisco IronPort Encryption Appliance および Cisco IronPort PostX の管理者インターフェースにおけるクロスサイトリクエストフォージェリの脆弱性 Cisco IronPort Encryption Appliance および Cisco IronPort PostX の管理者インターフェースには、クロスサイトリクエストフォージェリの脆弱性が存在します。 CVE-2009-0055 37486 6.8 http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-001682.html  View