NVD

Id
50837  
Name
CVE-2009-3639  
Description
The mod_tls module in ProFTPD before 1.3.2b, and 1.3.3 before 1.3.3rc2, when the dNSNameRequired TLS option is enabled, does not properly handle a "" character in a domain name in the Subject Alternative Name field of an X.509 client certificate, which allows remote attackers to bypass intended client-hostname restrictions via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.  
Reject
 
CVSS Version
2  
CVSS Score
5.8  
Severity
Medium  
CVSS Base Score
5.8  
CVSS Impact Subscore
4.9  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:N/I:P/A:P)  
Pub Date
2017-01-07  
Published
2009-10-28  
Modified Date
2009-12-19  
Seq
2009-3639  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
257395 50837 CVE-2009-3639 http://bugs.proftpd.org/show_bug.cgi?id=3275  View
257396 50837 CVE-2009-3639 [oss-security] 20091023 proftpd - mod_tls - Improper SSL/TLS certificate subjectAltName verification  View
257397 50837 CVE-2009-3639 [oss-security] 20091023 Re: proftpd - mod_tls - Improper SSL/TLS certificate subjectAltName verification  View
257398 50837 CVE-2009-3639 DSA-1925  View
257399 50837 CVE-2009-3639 MDVSA-2009:288  View
257400 50837 CVE-2009-3639 36804  View
257401 50837 CVE-2009-3639 proftpd-modtls-security-bypass(53936)  View
257402 50837 CVE-2009-3639 https://bugzilla.redhat.com/show_bug.cgi?id=530719  View
257403 50837 CVE-2009-3639 FEDORA-2009-11649  View
257404 50837 CVE-2009-3639 FEDORA-2009-11666  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
41302 JVNDB-2009-002309 ProFTPD の mod_tls モジュールにおける client-hostname 制限を回避される脆弱性 ProFTPD の mod_tls モジュールには、dNSNameRequired TLS オプションが有効な場合、X.509 クライアント証明書内の Subject Alternative Name フィールドにある "" を適切に処理しないため、client-hostname 制限を回避される脆弱性が存在します。 CVE-2009-3639 41070 CVE-2009-3639 50837 5.8 http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-002309.html 2009-10-20 2009-12-10 View