NVD

Id
49663  
Name
CVE-2009-2417  
Description
lib/ssluse.c in cURL and libcurl 7.4 through 7.19.5, when OpenSSL is used, does not properly handle a "" character in a domain name in the subject"s Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.  
Reject
 
CVSS Version
2  
CVSS Score
7.5  
Severity
High  
CVSS Base Score
7.5  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-07  
Published
2009-08-14  
Modified Date
2011-10-29  
Seq
2009-2417  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
251059 49663 CVE-2009-2417 http://curl.haxx.se/CVE-2009-2417/curl-7.10.6-CVE-2009-2417.patch  View
251060 49663 CVE-2009-2417 http://curl.haxx.se/CVE-2009-2417/curl-7.11.0-CVE-2009-2417.patch  View
251061 49663 CVE-2009-2417 http://curl.haxx.se/CVE-2009-2417/curl-7.12.1-CVE-2009-2417.patch  View
251062 49663 CVE-2009-2417 http://curl.haxx.se/CVE-2009-2417/curl-7.15.1-CVE-2009-2417.patch  View
251063 49663 CVE-2009-2417 http://curl.haxx.se/CVE-2009-2417/curl-7.15.5-CVE-2009-2417.patch  View
251064 49663 CVE-2009-2417 http://curl.haxx.se/CVE-2009-2417/curl-7.16.4-CVE-2009-2417.patch  View
251065 49663 CVE-2009-2417 http://curl.haxx.se/CVE-2009-2417/curl-7.18.1-CVE-2009-2417.patch  View
251066 49663 CVE-2009-2417 http://curl.haxx.se/CVE-2009-2417/curl-7.19.0-CVE-2009-2417.patch  View
251067 49663 CVE-2009-2417 http://curl.haxx.se/CVE-2009-2417/curl-7.19.5-CVE-2009-2417.patch  View
251068 49663 CVE-2009-2417 http://curl.haxx.se/docs/adv_20090812.txt  View
251069 49663 CVE-2009-2417 APPLE-SA-2010-03-29-1  View
251070 49663 CVE-2009-2417 oval:org.mitre.oval:def:10114  View
251071 49663 CVE-2009-2417 oval:org.mitre.oval:def:8542  View
251072 49663 CVE-2009-2417 http://shibboleth.internet2.edu/secadv/secadv_20090817.txt  View
251073 49663 CVE-2009-2417 http://support.apple.com/kb/HT4077  View
251074 49663 CVE-2009-2417 http://wiki.rpath.com/Advisories:rPSA-2009-0124  View
251075 49663 CVE-2009-2417 20090824 rPSA-2009-0124-1 curl  View
251076 49663 CVE-2009-2417 20091120 VMSA-2009-0016 VMware vCenter and ESX update release and vMA patch release address multiple security issue in third party components  View
251077 49663 CVE-2009-2417 36032  View
251078 49663 CVE-2009-2417 USN-1158-1  View
251079 49663 CVE-2009-2417 http://www.vmware.com/security/advisories/VMSA-2009-0016.html  View
251080 49663 CVE-2009-2417 ADV-2009-2263  View
251081 49663 CVE-2009-2417 ADV-2009-3316  View
251082 49663 CVE-2009-2417 curl-certificate-security-bypass(52405)  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
41033 JVNDB-2009-002039 cURL および libcurl における、任意の SSL サーバになりすまされる脆弱性 cURL および libcurl には、OpenSSL を使用している場合に X.509 証明書の Common Name (CN) フィールドにあるドメイン名内の "" 文字を適切に処理しないため、任意の SSL サーバになりすまされる脆弱性が存在します。 CVE-2009-2417 39848 CVE-2009-2417 49663 7.5 http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-002039.html 2009-08-12 2010-04-13 View