CVE-2009-2408

Published Jul 30, 2009

Last updated 9 months ago

Overview

Description: Mozilla Network Security Services (NSS) before 3.12.3, Firefox before 3.0.13, Thunderbird before 2.0.0.23, and SeaMonkey before 1.1.18 do not properly handle a '\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority. NOTE: this was originally reported for Firefox before 3.5.
Source: secalert@redhat.com
NVD status: Analyzed

Hype score: Not currently trending

Risk scores

CVSS 3.1

Type: Primary
Base score: 5.9
Impact score: 3.6
Exploitability score: 2.2
Vector string: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Severity: MEDIUM

CVSS 2.0

Type: Primary
Base score: 6.8
Impact score: 6.4
Exploitability score: 8.6
Vector string: AV:N/AC:M/Au:N/C:P/I:P/A:P

Weaknesses

nvd@nist.gov: CWE-295

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "311A4763-8018-4394-946D-C75220572EA5",
            "versionEndExcluding": "3.0.13"
          },
          {
            "criteria": "cpe:2.3:a:mozilla:network_security_services:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "A21F310D-7D9F-45D7-974D-C615F99FBEB8",
            "versionEndExcluding": "3.12.3"
          },
          {
            "criteria": "cpe:2.3:a:mozilla:seamonkey:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "336E3C0C-0197-40FD-AD68-C13C518858C8",
            "versionEndExcluding": "1.1.18"
          },
          {
            "criteria": "cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "C213A6FE-549A-4B85-BCBE-11CAF63A376C",
            "versionEndExcluding": "2.0.0.23"
          }
        ],
        "operator": "OR"
      }
    ]
  },
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:opensuse:opensuse:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "FF141FBE-4CA5-4695-94A0-8BE1309D28CC",
            "versionEndIncluding": "11.1",
            "versionStartIncluding": "10.3"
          },
          {
            "criteria": "cpe:2.3:o:suse:linux_enterprise:10.0:-:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "AED08A6F-CD23-4405-B1CF-C96BB8AE7D6B"
          },
          {
            "criteria": "cpe:2.3:o:suse:linux_enterprise:11.0:-:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "1608E282-2E96-4447-848D-DBE915DB0EF9"
          },
          {
            "criteria": "cpe:2.3:o:suse:linux_enterprise_server:9:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "4CD2D897-E321-4CED-92E0-11A98B52053C"
          }
        ],
        "operator": "OR"
      }
    ]
  },
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:debian:debian_linux:5.0:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "8C757774-08E7-40AA-B532-6F705C8F7639"
          }
        ],
        "operator": "OR"
      }
    ]
  },
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:canonical:ubuntu_linux:8.04:*:*:*:-:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "7EBFE35C-E243-43D1-883D-4398D71763CC"
          },
          {
            "criteria": "cpe:2.3:o:canonical:ubuntu_linux:8.10:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "4747CC68-FAF4-482F-929A-9DA6C24CB663"
          },
          {
            "criteria": "cpe:2.3:o:canonical:ubuntu_linux:9.04:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "A5D026D0-EF78-438D-BEDD-FC8571F3ACEB"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

Overview

Social media

Risk scores

CVSS 3.1

CVSS 2.0

Weaknesses

Configurations

References