CVE-2009-3490 Security feature bypass in n/a
Man-in-the-middle attackers can spoof SSL servers by exploiting improper null character handling in X.509 certificate Common Name fields.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2009-3490?
CVE-2009-3490 is a medium-severity vulnerability in n/a, published on 30 Sep 2009. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
GNU Wget before 1.12 does not properly handle a '\0' character in a domain name in the Common Name field of an X.509 certificate, which allows man-in-the-middle remote attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.
Weakness: CWE-310
Which versions are affected by CVE-2009-3490?
It affects 1 product.
Linux distribution packages (20)
wget Red Hat:enterprise_linux:3::as | All versions | 0:1.10.2-0.30E.1 |
wget-debuginfo Red Hat:enterprise_linux:3::as | All versions | 0:1.10.2-0.30E.1 |
wget Red Hat:enterprise_linux:3::desktop | All versions | 0:1.10.2-0.30E.1 |
wget-debuginfo Red Hat:enterprise_linux:3::desktop | All versions | 0:1.10.2-0.30E.1 |
wget Red Hat:enterprise_linux:3::es | All versions | 0:1.10.2-0.30E.1 |
wget-debuginfo Red Hat:enterprise_linux:3::es | All versions | 0:1.10.2-0.30E.1 |
wget Red Hat:enterprise_linux:3::ws | All versions | 0:1.10.2-0.30E.1 |
wget-debuginfo Red Hat:enterprise_linux:3::ws | All versions | 0:1.10.2-0.30E.1 |
wget Red Hat:enterprise_linux:4::as | All versions | 0:1.10.2-1.el4_8.1 |
wget-debuginfo Red Hat:enterprise_linux:4::as | All versions | 0:1.10.2-1.el4_8.1 |
wget Red Hat:enterprise_linux:4::desktop | All versions | 0:1.10.2-1.el4_8.1 |
wget-debuginfo Red Hat:enterprise_linux:4::desktop | All versions | 0:1.10.2-1.el4_8.1 |
wget Red Hat:enterprise_linux:4::es | All versions | 0:1.10.2-1.el4_8.1 |
wget-debuginfo Red Hat:enterprise_linux:4::es | All versions | 0:1.10.2-1.el4_8.1 |
wget Red Hat:enterprise_linux:4::ws | All versions | 0:1.10.2-1.el4_8.1 |
wget-debuginfo Red Hat:enterprise_linux:4::ws | All versions | 0:1.10.2-1.el4_8.1 |
wget Red Hat:enterprise_linux:5::client | All versions | 0:1.11.4-2.el5_4.1 |
wget-debuginfo Red Hat:enterprise_linux:5::client | All versions | 0:1.11.4-2.el5_4.1 |
wget Red Hat:enterprise_linux:5::server | All versions | 0:1.11.4-2.el5_4.1 |
wget-debuginfo Red Hat:enterprise_linux:5::server | All versions | 0:1.11.4-2.el5_4.1 |
Products include Gnu Wget.
How do I fix CVE-2009-3490?
Upgrade to a fixed version.
Is CVE-2009-3490 being exploited?
There is no known exploitation of CVE-2009-3490 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as DEBIAN-CVE-2009-3490, DSA-1904-1, GHSA-6p5c-44cm-r9m8, RHSA-2009:1549.