SuSE 11 Security Update : Mozilla (SAT Patch Number 1304)

This script is Copyright (C) 2013 Tenable Network Security, Inc.


Synopsis :

The remote SuSE 11 host is missing one or more security updates.

Description :

Mozilla Thunderbird was updated to version 2.0.0.23.

The release fixes one security issue: MFSA 2009-42 / CVE-2009-2408:
IOActive security researcher Dan Kaminsky reported a mismatch in the
treatment of domain names in SSL certificates between SSL clients and
the Certificate Authorities (CA) which issue server certificates. In
particular, if a malicious person requested a certificate for a host
name with an invalid null character in it most CAs would issue the
certificate if the requester owned the domain specified after the
null, while most SSL clients (browsers) ignored that part of the name
and used the unvalidated part in front of the null. This made it
possible for attackers to obtain certificates that would function for
any site they wished to target. These certificates could be used to
intercept and potentially alter encrypted communication between the
client and a server such as sensitive bank account transactions. This
vulnerability was independently reported to us by researcher Moxie
Marlinspike who also noted that since Firefox relies on SSL to protect
the integrity of security updates this attack could be used to serve
malicious updates.

See also :

http://www.mozilla.org/security/announce/2009/mfsa2009-42.html
https://bugzilla.novell.com/show_bug.cgi?id=534782
http://support.novell.com/security/cve/CVE-2009-2408.html

Solution :

Apply SAT patch number 1304.

Risk factor :

Medium / CVSS Base Score : 6.8
(CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P)

Family: SuSE Local Security Checks

Nessus Plugin ID: 64209 ()

Bugtraq ID:

CVE ID: CVE-2009-2408

Ready to Amp Up Your Nessus Experience?

Get Nessus Professional to scan unlimited IPs, run compliance checks & more

Buy Nessus Professional Now