NVD

Id
4776  
Name
CVE-2008-4989  
Description
The _gnutls_x509_verify_certificate function in lib/x509/verify.c in libgnutls in GnuTLS before 2.6.1 trusts certificate chains in which the last certificate is an arbitrary trusted, self-signed certificate, which allows man-in-the-middle attackers to insert a spoofed certificate for any Distinguished Name (DN).  
Reject
 
CVSS Version
2  
CVSS Score
4.3  
Severity
Medium  
CVSS Base Score
4.3  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:N/I:P/A:N)  
Pub Date
2017-01-03  
Published
2008-11-12  
Modified Date
2012-10-30  
Seq
2008-4989  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
29860 4776 CVE-2008-4989 [gnutls-devel] 20081110 GnuTLS 2.6.1 - Security release [GNUTLS-SA-2008-3]  View
29861 4776 CVE-2008-4989 [gnutls-devel] 20081110 Analysis of vulnerability GNUTLS-SA-2008-3 CVE-2008-4989  View
29862 4776 CVE-2008-4989 SUSE-SR:2008:027  View
29863 4776 CVE-2008-4989 SUSE-SR:2009:009  View
29864 4776 CVE-2008-4989 oval:org.mitre.oval:def:11650  View
29865 4776 CVE-2008-4989 GLSA-200901-10  View
29866 4776 CVE-2008-4989 260528  View
29867 4776 CVE-2008-4989 http://wiki.rpath.com/Advisories:rPSA-2008-0322  View
29868 4776 CVE-2008-4989 DSA-1719  View
29869 4776 CVE-2008-4989 http://www.gnu.org/software/gnutls/security.html  View
29870 4776 CVE-2008-4989 MDVSA-2008:227  View
29871 4776 CVE-2008-4989 RHSA-2008:0982  View
29872 4776 CVE-2008-4989 20081117 rPSA-2008-0322-1 gnutls  View
29873 4776 CVE-2008-4989 32232  View
29874 4776 CVE-2008-4989 1021167  View
29875 4776 CVE-2008-4989 USN-678-2  View
29876 4776 CVE-2008-4989 USN-678-1  View
29877 4776 CVE-2008-4989 ADV-2008-3086  View
29878 4776 CVE-2008-4989 ADV-2009-1567  View
29879 4776 CVE-2008-4989 gnutls-x509-name-spoofing(46482)  View
29880 4776 CVE-2008-4989 https://issues.rpath.com/browse/RPL-2886  View
29881 4776 CVE-2008-4989 FEDORA-2008-9530  View
29882 4776 CVE-2008-4989 FEDORA-2008-9600  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
46631 JVNDB-2008-001941 GnuTLS libgnutls の _gnutls_x509_verify_certificate 関数における証明書の DN を偽装される脆弱性 GnuTLS の libgnutls 内にある lib/x509/verify.c の _gnutls_x509_verify_certificate 関数には、証明書チェーンの処理に不備があるため、中間者攻撃により証明書の Distinguished Name (DN) を偽装される脆弱性が存在します。 CVE-2008-4989 35102 CVE-2008-4989 4776 4.3 http://jvndb.jvn.jp/ja/contents/2008/JVNDB-2008-001941.html 2008-11-11 2009-07-23 View