NVD

Id
49655  
Name
CVE-2009-2408  
Description
Mozilla Network Security Services (NSS) before 3.12.3, Firefox before 3.0.13, Thunderbird before 2.0.0.23, and SeaMonkey before 1.1.18 do not properly handle a "" character in a domain name in the subject"s Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority. NOTE: this was originally reported for Firefox before 3.5.  
Reject
 
CVSS Version
2  
CVSS Score
6.8  
Severity
Medium  
CVSS Base Score
6.8  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-07  
Published
2009-07-30  
Modified Date
2012-10-22  
Seq
2009-2408  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
250896 49655 CVE-2009-2408 http://isc.sans.org/diary.html?storyid=7003  View
250897 49655 CVE-2009-2408 SUSE-SR:2009:018  View
250898 49655 CVE-2009-2408 [oss-security] 20090903 More CVE-2009-2408 like issues  View
250899 49655 CVE-2009-2408 oval:org.mitre.oval:def:10751  View
250900 49655 CVE-2009-2408 oval:org.mitre.oval:def:8458  View
250901 49655 CVE-2009-2408 1021030  View
250902 49655 CVE-2009-2408 DSA-1874  View
250903 49655 CVE-2009-2408 MDVSA-2009:197  View
250904 49655 CVE-2009-2408 MDVSA-2009:216  View
250905 49655 CVE-2009-2408 MDVSA-2009:217  View
250906 49655 CVE-2009-2408 http://www.mozilla.org/security/announce/2009/mfsa2009-42.html  View
250907 49655 CVE-2009-2408 SUSE-SA:2009:048  View
250908 49655 CVE-2009-2408 http://www.openldap.org/devel/cvsweb.cgi/libraries/libldap/tls_m.c.diff?r1=1.8&r2=1.11&f=h  View
250909 49655 CVE-2009-2408 RHSA-2009:1207  View
250910 49655 CVE-2009-2408 RHSA-2009:1432  View
250911 49655 CVE-2009-2408 1022632  View
250912 49655 CVE-2009-2408 USN-810-1  View
250913 49655 CVE-2009-2408 USN-810-2  View
250914 49655 CVE-2009-2408 ADV-2009-2085  View
250915 49655 CVE-2009-2408 ADV-2009-3184  View
250916 49655 CVE-2009-2408 http://www.wired.com/threatlevel/2009/07/kaminsky/  View
250917 49655 CVE-2009-2408 https://bugzilla.redhat.com/show_bug.cgi?id=510251  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
40950 JVNDB-2009-001956 複数の Mozilla 製品 における任意の SSL サーバになりすまされる脆弱性 複数の Mozilla 製品 には、X.509 証明書の Common Name (CN) フィールドにあるドメイン名内の "" 文字を適切に処理しないため、任意の SSL サーバになりすまされる脆弱性が存在します。 CVE-2009-2408 39839 CVE-2009-2408 49655 7.5 http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-001956.html 2009-08-01 2009-12-17 View