NVD

Id
50945  
Name
CVE-2009-3766  
Description
mutt_ssl.c in mutt 1.5.16 and other versions before 1.5.19, when OpenSSL is used, does not verify the domain name in the subject"s Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.  
Reject
 
CVSS Version
2  
CVSS Score
6.8  
Severity
Medium  
CVSS Base Score
6.8  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-07  
Published
2009-10-23  
Modified Date
2010-12-01  
Seq
2009-3766  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
257979 50945 CVE-2009-3766 http://dev.mutt.org/trac/ticket/3087  View
257980 50945 CVE-2009-3766 [oss-security] 20090903 More CVE-2009-2408 like issues  View
257981 50945 CVE-2009-3766 [oss-security] 20091026 Re: More CVE-2009-2408 like issues  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
44070 JVNDB-2009-005077 Mutt の mutt_ssl.c における SSL サーバになりすまされる脆弱性 Mutt の mutt_ssl.c は、OpenSSL が使用されている際、X.509 証明書の subject の Common Name (CN) フィールドのドメイン名を適切に確認しないため、SSL サーバになりすまされる脆弱性が存在します。 CVE-2009-3766 41197 CVE-2009-3766 50945 6.8 http://jvndb.jvn.jp/ja/contents/2009/JVNDB-2009-005077.html 2009-10-23 2012-09-25 View