CVE-2009-0653 Security feature bypass in n/a
Remote attackers can spoof trusted site certificates via man-in-the-middle attacks due to missing Basic Constraints verification in OpenSSL.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2009-0653?
CVE-2009-0653 is a high-severity vulnerability in Openssl Openssl, published on 20 Feb 2009. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
OpenSSL, probably 0.9.6, does not verify the Basic Constraints for an intermediate CA-signed certificate, which allows remote attackers to spoof the certificates of trusted sites via a man-in-the-middle attack, a related issue to CVE-2002-0970.
Weakness: CWE-287
Which versions are affected by CVE-2009-0653?
It affects 1 product.
Products include Openssl Openssl.
How do I fix CVE-2009-0653?
Upgrade to a fixed version.
Is CVE-2009-0653 being exploited?
There is no known exploitation of CVE-2009-0653 in the wild and no public exploit code.
Other vulnerabilities in Openssl Openssl
Sources
Also known as DEBIAN-CVE-2009-0653, GHSA-gj63-3383-h48m.