CVE-2009-0049 Security feature bypass in n/a
Remote attackers can bypass SSL/TLS certificate validation in Belgian eID middleware by exploiting improper signature verification checks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2009-0049?
CVE-2009-0049 is a medium-severity vulnerability in n/a, published on 7 Jan 2009. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Belgian eID middleware (eidlib) 2.6.0 and earlier does not properly check the return value from the OpenSSL EVP_VerifyFinal function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature for DSA and ECDSA keys, a similar vulnerability to CVE-2008-5077.
Weakness: CWE-287
Which versions are affected by CVE-2009-0049?
It affects 1 product.
Products include Eid Eidlib.
How do I fix CVE-2009-0049?
Upgrade to a fixed version.
Is CVE-2009-0049 being exploited?
There is no known exploitation of CVE-2009-0049 in the wild and no public exploit code.
Sources
Also known as DSA-1946-1, GHSA-j42w-rpgw-49cw.