CVE-2009-3767 Security feature bypass in n/a
Man-in-the-middle attackers can spoof SSL servers by exploiting improper handling of null characters in X.509 certificate Common Names.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2009-3767?
CVE-2009-3767 is a medium-severity vulnerability in Apple Mac Os X, published on 23 Oct 2009. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
libraries/libldap/tls_o.c in OpenLDAP 2.2 and 2.4, and possibly other versions, when OpenSSL is used, does not properly handle a '\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.
Weakness: CWE-295
Which versions are affected by CVE-2009-3767?
It affects 3 products.
Linux distribution packages (18)
compat-openldap Red Hat:enterprise_linux:5::client | All versions | 0:2.3.43_2.2.29-12.el5 |
openldap Red Hat:enterprise_linux:5::client | All versions | 0:2.3.43-12.el5 |
openldap-clients Red Hat:enterprise_linux:5::client | All versions | 0:2.3.43-12.el5 |
openldap-debuginfo Red Hat:enterprise_linux:5::client | All versions | 0:2.3.43-12.el5 |
openldap Red Hat:enterprise_linux:5::client_workstation | All versions | 0:2.3.43-12.el5 |
openldap-debuginfo Red Hat:enterprise_linux:5::client_workstation | All versions | 0:2.3.43-12.el5 |
openldap-devel Red Hat:enterprise_linux:5::client_workstation | All versions | 0:2.3.43-12.el5 |
openldap-servers Red Hat:enterprise_linux:5::client_workstation | All versions | 0:2.3.43-12.el5 |
openldap-servers-overlays Red Hat:enterprise_linux:5::client_workstation | All versions | 0:2.3.43-12.el5 |
openldap-servers-sql Red Hat:enterprise_linux:5::client_workstation | All versions | 0:2.3.43-12.el5 |
compat-openldap Red Hat:enterprise_linux:5::server | All versions | 0:2.3.43_2.2.29-12.el5 |
openldap Red Hat:enterprise_linux:5::server | All versions | 0:2.3.43-12.el5 |
openldap-clients Red Hat:enterprise_linux:5::server | All versions | 0:2.3.43-12.el5 |
openldap-debuginfo Red Hat:enterprise_linux:5::server | All versions | 0:2.3.43-12.el5 |
openldap-devel Red Hat:enterprise_linux:5::server | All versions | 0:2.3.43-12.el5 |
openldap-servers Red Hat:enterprise_linux:5::server | All versions | 0:2.3.43-12.el5 |
openldap-servers-overlays Red Hat:enterprise_linux:5::server | All versions | 0:2.3.43-12.el5 |
openldap-servers-sql Red Hat:enterprise_linux:5::server | All versions | 0:2.3.43-12.el5 |
Products include Apple Mac Os X, Fedoraproject Fedora, Openldap Openldap.
How do I fix CVE-2009-3767?
Upgrade to a fixed version.
Is CVE-2009-3767 being exploited?
There is no known exploitation of CVE-2009-3767 in the wild and no public exploit code.
Other vulnerabilities in Apple Mac Os X
Sources
Also known as DEBIAN-CVE-2009-3767, DSA-1943-1, GHSA-hc4m-gmh3-4vxp, RHSA-2010:0198.