CVE

Id
41463  
CVE No.
CVE-2009-4028  
Status
Candidate  
Description
The vio_verify_callback function in viosslfactories.c in MySQL 5.0.x before 5.0.88 and 5.1.x before 5.1.41, when OpenSSL is used, accepts a value of zero for the depth of X.509 certificates, which allows man-in-the-middle attackers to spoof arbitrary SSL-based MySQL servers via a crafted certificate, as demonstrated by a certificate presented by a server linked against the yaSSL library.  
Phase
Assigned (20091120)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
455589 41463 CVE-2009-4028 MLIST:[commits] 20091020 bzr commit into mysql-4.1 branch (joro:2709) Bug#47320  View
455590 41463 CVE-2009-4028 URL:http://lists.mysql.com/commits/87446  View
455591 41463 CVE-2009-4028 MLIST:[oss-security] 20091119 mysql-5.1.41  View
455592 41463 CVE-2009-4028 URL:http://www.openwall.com/lists/oss-security/2009/11/19/3  View
455593 41463 CVE-2009-4028 MLIST:[oss-security] 20091121 CVE Request - MySQL - 5.0.88  View
455594 41463 CVE-2009-4028 URL:http://marc.info/?l=oss-security&m=125881733826437&w=2  View
455595 41463 CVE-2009-4028 MLIST:[oss-security] 20091123 Re: mysql-5.1.41  View
455596 41463 CVE-2009-4028 URL:http://www.openwall.com/lists/oss-security/2009/11/23/16  View
455597 41463 CVE-2009-4028 CONFIRM:http://bugs.mysql.com/47320  View
455598 41463 CVE-2009-4028 CONFIRM:http://dev.mysql.com/doc/refman/5.0/en/news-5-0-88.html  View
455599 41463 CVE-2009-4028 CONFIRM:http://dev.mysql.com/doc/refman/5.1/en/news-5-1-41.html  View
455600 41463 CVE-2009-4028 REDHAT:RHSA-2010:0109  View
455601 41463 CVE-2009-4028 URL:http://www.redhat.com/support/errata/RHSA-2010-0109.html  View
455602 41463 CVE-2009-4028 SUSE:SUSE-SR:2010:011  View
455603 41463 CVE-2009-4028 URL:http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00001.html  View
455604 41463 CVE-2009-4028 OVAL:oval:org.mitre.oval:def:10940  View
455605 41463 CVE-2009-4028 URL:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:10940  View
455606 41463 CVE-2009-4028 OVAL:oval:org.mitre.oval:def:8510  View
455607 41463 CVE-2009-4028 URL:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:8510  View
455608 41463 CVE-2009-4028 VUPEN:ADV-2010-1107  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
42894 JVNDB-2009-003901 Cacti におけるクロスサイトスクリプティングの脆弱性 Cacti には、以下に関連する処理に不備があるため、クロスサイトスクリプティングの脆弱性が存在します。 CVE-2009-4032 41463 4.3 http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-003901.html  View