NVD

Id
49755  
Name
CVE-2009-2510  
Description
The CryptoAPI component in Microsoft Windows 2000 SP4, Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista Gold, SP1, and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7, as used by Internet Explorer and other applications, does not properly handle a "" character in a domain name in the subject"s Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, aka "Null Truncation in X.509 Common Name Vulnerability," a related issue to CVE-2009-2408.  
Reject
 
CVSS Version
2  
CVSS Score
6.8  
Severity
Medium  
CVSS Base Score
6.8  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-07  
Published
2009-10-14  
Modified Date
2010-08-21  
Seq
2009-2510  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
251613 49755 CVE-2009-2510 oval:org.mitre.oval:def:5842  View
251614 49755 CVE-2009-2510 MS09-056  View
251615 49755 CVE-2009-2510 http://www.networkworld.com/news/2009/073009-more-holes-found-in-webs.html  View
251616 49755 CVE-2009-2510 http://www.networkworld.com/news/2009/091709-microsoft-ie-security-hole.html  View
251617 49755 CVE-2009-2510 36475  View
251618 49755 CVE-2009-2510 TA09-286A  View
251619 49755 CVE-2009-2510 http://www.wired.com/threatlevel/2009/07/kaminsky/  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
41235 JVNDB-2009-002242 Microsoft Windows の CryptoAPI コンポーネントにおける任意の SSL サーバになりすまされる脆弱性 Microsoft Windows の CryptoAPI コンポーネントには、X.509 証明書内の Common Name (CN) フィールドにある "" 文字を適切に処理しないため、任意の SSL サーバになりすまされる脆弱性が存在します。 CVE-2009-2510 39941 CVE-2009-2510 49755 6.8 http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-002242.html 2009-10-13 2009-11-19 View