Detections
Analytics
CVE-2009-2417high
Description
lib/ssluse.c in cURL and libcurl 7.4 through 7.19.5, when OpenSSL is used, does not properly handle a '\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.
References
http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html
http://secunia.com/advisories/36238
http://secunia.com/advisories/36475
http://secunia.com/advisories/37471
http://secunia.com/advisories/45047
https://exchange.xforce.ibmcloud.com/vulnerabilities/52405
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10114
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8542
http://support.apple.com/kb/HT4077
http://wiki.rpath.com/Advisories:rPSA-2009-0124
http://www.ubuntu.com/usn/USN-1158-1
http://www.vmware.com/security/advisories/VMSA-2009-0016.html