NVD

Id
47396  
Name
CVE-2009-0050  
Description
Lasso 2.2.1 and earlier does not properly check the return value from the OpenSSL DSA_verify function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature, a similar vulnerability to CVE-2008-5077.  
Reject
 
CVSS Version
2  
CVSS Score
4.3  
Severity
Medium  
CVSS Base Score
4.3  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:N/I:P/A:N)  
Pub Date
2017-01-07  
Published
2009-01-07  
Modified Date
2012-10-30  
Seq
2009-0050  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
237162 47396 CVE-2009-0050 http://www.ocert.org/advisories/ocert-2008-016.html  View
237163 47396 CVE-2009-0050 20090107 [oCERT-2008-016] Multiple OpenSSL signature verification API misuses  View
237164 47396 CVE-2009-0050 openssl-dsa-verify-security-bypass(47837)  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
43402 JVNDB-2009-004409 Lasso における証明書チェーンの検証を回避される脆弱性 Lasso は、OpenSSL DSA_verify 関数からのリターン値を適切にチェックしないため、証明書チェーンの検証を回避される脆弱性が存在します。 CVE-2009-0050 37481 CVE-2009-0050 47396 4.3 http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-004409.html 2009-01-07 2012-09-25 View