NVD

Id
49907  
Name
CVE-2009-2666  
Description
socket.c in fetchmail before 6.3.11 does not properly handle a "" character in a domain name in the subject"s Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.  
Reject
 
CVSS Version
2  
CVSS Score
6.4  
Severity
Medium  
CVSS Base Score
6.4  
CVSS Impact Subscore
4.9  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:P/I:P/A:N)  
Pub Date
2017-01-07  
Published
2009-08-07  
Modified Date
2011-02-15  
Seq
2009-2666  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
252305 49907 CVE-2009-2666 http://fetchmail.berlios.de/fetchmail-SA-2009-01.txt  View
252306 49907 CVE-2009-2666 APPLE-SA-2009-11-09-1  View
252307 49907 CVE-2009-2666 [oss-security] 20090805 Re: CVE request: fetchmail <= 6.3.10 SSL certificate  View
252308 49907 CVE-2009-2666 oval:org.mitre.oval:def:11059  View
252309 49907 CVE-2009-2666 http://support.apple.com/kb/HT3937  View
252310 49907 CVE-2009-2666 DSA-1852  View
252311 49907 CVE-2009-2666 MDVSA-2009:201  View
252312 49907 CVE-2009-2666 20090806 fetchmail security announcement fetchmail-SA-2009-01 (CVE-2009-2666)  View
252313 49907 CVE-2009-2666 35951  View
252314 49907 CVE-2009-2666 1022679  View
252315 49907 CVE-2009-2666 SSA:2009-218-01  View
252316 49907 CVE-2009-2666 ADV-2009-2155  View
252317 49907 CVE-2009-2666 ADV-2009-3184  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
41088 JVNDB-2009-002095 fetchmail における任意の SSL サーバになりすまされる脆弱性 fetchmail の socket.c には、X.509 証明書の Common Name (CN) 内のドメイン名にある "" 文字を適切に処理しないため、任意の SSL サーバになりすまされる脆弱性が存在します。 CVE-2009-2666 40097 CVE-2009-2666 49907 6.4 http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-002095.html 2009-08-06 2010-12-15 View