NVD

Id
49719  
Name
CVE-2009-2474  
Description
neon before 0.28.6, when OpenSSL or GnuTLS is used, does not properly handle a "" character in a domain name in the subject"s Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.  
Reject
 
CVSS Version
2  
CVSS Score
6.8  
Severity
Medium  
CVSS Base Score
6.8  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-07  
Published
2009-08-21  
Modified Date
2010-11-18  
Seq
2009-2474  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
251397 49719 CVE-2009-2474 APPLE-SA-2010-11-10-1  View
251398 49719 CVE-2009-2474 [neon] 20090818 neon: release 0.28.6 (SECURITY)  View
251399 49719 CVE-2009-2474 [neon] 20090818 CVE-2009-2474: fix handling of NUL in SSL cert subject names  View
251400 49719 CVE-2009-2474 oval:org.mitre.oval:def:11721  View
251401 49719 CVE-2009-2474 http://support.apple.com/kb/HT4435  View
251402 49719 CVE-2009-2474 MDVSA-2009:221  View
251403 49719 CVE-2009-2474 36079  View
251404 49719 CVE-2009-2474 USN-835-1  View
251405 49719 CVE-2009-2474 ADV-2009-2341  View
251406 49719 CVE-2009-2474 FEDORA-2009-8794  View
251407 49719 CVE-2009-2474 FEDORA-2009-8815  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
41161 JVNDB-2009-002168 neon における X.509 証明書の処理に関する任意の SSL サーバになりすまされる脆弱性 neon には、OpenSSL 、または GnuTLS を使用している場合に X.509 証明書の Common Name (CN) フィールド内のドメイン名にある "" を適切に処理しないため、任意の SSL サーバになりすまされる脆弱性が存在します。 CVE-2009-2474 39905 CVE-2009-2474 49719 6.8 http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-002168.html 2009-08-18 2010-11-25 View