CVE-2009-2417

HIGH

Description

lib/ssluse.c in cURL and libcurl 7.4 through 7.19.5, when OpenSSL is used, does not properly handle a '\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.

ID	Name	Product	Family	Severity
89117	VMware ESX / ESXi Multiple Vulnerabilities (VMSA-2009-0016) (remote check)	Nessus	Misc.	critical
79463	OracleVM 2.1 : curl (OVMSA-2009-0019)	Nessus	OracleVM Local Security Checks	high
67910	Oracle Linux 3 / 4 / 5 : curl (ELSA-2009-1209)	Nessus	Oracle Linux Local Security Checks	high
65043	Scientific Linux Security Update : curl on SL4.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	high
60640	Scientific Linux Security Update : curl on SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	high
60639	Scientific Linux Security Update : curl on SL3.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	high
55414	Ubuntu 8.04 LTS / 10.04 LTS / 10.10 / 11.04 : curl vulnerabilities (USN-1158-1)	Nessus	Ubuntu Local Security Checks	high
800787	Mac OS X < 10.6.3 Multiple Vulnerabilities	Log Correlation Engine	Operating System Detection	high
5489	Mac OS X < 10.6.3 Multiple Vulnerabilities	Nessus Network Monitor	Generic	critical
45373	Mac OS X Multiple Vulnerabilities (Security Update 2010-002)	Nessus	MacOS X Local Security Checks	critical
45372	Mac OS X 10.6.x < 10.6.3 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	critical
44734	Debian DSA-1869-1 : curl - insufficient input validation	Nessus	Debian Local Security Checks	high
42870	VMSA-2009-0016 : VMware vCenter and ESX update release and vMA patch release address multiple security issues in third party components.	Nessus	VMware ESX Local Security Checks	critical
42012	openSUSE 10 Security Update : libcurl3 (libcurl3-6401)	Nessus	SuSE Local Security Checks	high
42011	openSUSE 10 Security Update : libcurl2 (libcurl2-6404)	Nessus	SuSE Local Security Checks	high
41994	openSUSE 10 Security Update : curl (curl-6411)	Nessus	SuSE Local Security Checks	high
41637	GLSA-200909-20 : cURL: Certificate validation error	Nessus	Gentoo Local Security Checks	high
41517	SuSE 10 Security Update : GnuTLS (ZYPP Patch Number 6470)	Nessus	SuSE Local Security Checks	high
41497	SuSE 10 Security Update : curl (ZYPP Patch Number 6402)	Nessus	SuSE Local Security Checks	high
41489	SuSE 10 Security Update : compat-curl2 (ZYPP Patch Number 6408)	Nessus	SuSE Local Security Checks	high
41379	SuSE 11 Security Update : curl (SAT Patch Number 1173)	Nessus	SuSE Local Security Checks	high
41317	SuSE9 Security Update : curl (YOU Patch Number 12467)	Nessus	SuSE Local Security Checks	high
40788	openSUSE Security Update : curl (curl-1232)	Nessus	SuSE Local Security Checks	high
40657	Ubuntu 6.06 LTS / 8.04 LTS / 8.10 / 9.04 : curl vulnerability (USN-818-1)	Nessus	Ubuntu Local Security Checks	high
40650	openSUSE Security Update : curl (curl-1180)	Nessus	SuSE Local Security Checks	high
40643	openSUSE Security Update : curl (curl-1180)	Nessus	SuSE Local Security Checks	high
40608	RHEL 3 / 4 / 5 : curl (RHSA-2009:1209)	Nessus	Red Hat Local Security Checks	high
40598	Slackware 10.0 / 10.1 / 10.2 / 11.0 / 12.0 / 12.1 / 12.2 / 9.1 / current : curl (SSA:2009-226-01)	Nessus	Slackware Local Security Checks	high
40597	Mandriva Linux Security Advisory : curl (MDVSA-2009:203-1)	Nessus	Mandriva Local Security Checks	high
40593	CentOS 3 / 5 : curl (CESA-2009:1209)	Nessus	CentOS Local Security Checks	high
801389	Curl < 7.19.6 Certificate Validation Bypass Vulnerability	Log Correlation Engine	Web Clients	high
5130	Curl < 7.19.6 Certificate Validation Bypass Vulnerability	Nessus Network Monitor	Web Clients	medium

CVE-2009-2417

Description

References

Details

Risk Information

CVSS v2.0