PT-2009-1096 · Openssl+2 · Openssl+2

Scott Cantor · Published 2009-08-12 · Updated 2024-06-15 · CVE-2009-2417

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions cURL versions 7.4 through 7.19.5 cURL version 7.19.6 and earlier

Description The issue allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority. This is due to the faulty handling of a '0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate when OpenSSL is used. The vulnerability can be exploited remotely, potentially leading to a breach of confidentiality, integrity, and availability of protected information.

Recommendations For cURL versions 7.4 through 7.19.5, update to a version later than 7.19.5 to resolve the issue. For cURL version 7.19.6 and earlier, update to a version later than 7.19.6. As a temporary workaround, consider disabling the use of OpenSSL in cURL until a patch is available. Restrict access to SSL servers to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-170

CWE-310

Related Identifiers

BDU:2015-09400

BDU:2015-09905

CVE-2009-2417

DSA-1869-1

OPENSUSE-SU-2024:10303-1

RHSA-2009:1209

RHSA-2009_1209

Affected Products

Openssl

Red Hat

Curl

References · 111

• http://curl.haxx.se/CVE-2009-2417/curl-7.12.1-CVE-2009-2417.patch · Patch
• http://curl.haxx.se/docs/adv_20090812.txt · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-09400 · Security Note
• http://curl.haxx.se/CVE-2009-2417/curl-7.16.4-CVE-2009-2417.patch · Vendor Advisory
• http://curl.haxx.se/CVE-2009-2417/curl-7.15.5-CVE-2009-2417.patch · Patch
• https://osv.dev/vulnerability/CVE-2009-2417 · Vendor Advisory
• http://vupen.com/english/advisories/2009/2263 · Vendor Advisory
• http://curl.haxx.se/CVE-2009-2417/curl-7.10.6-CVE-2009-2417.patch · Patch
• https://osv.dev/vulnerability/openSUSE-SU-2024:10303-1 · Vendor Advisory
• https://osv.dev/vulnerability/CURL-CVE-2009-2417 · Vendor Advisory
• http://curl.haxx.se/CVE-2009-2417/curl-7.15.1-CVE-2009-2417.patch · Patch
• https://bdu.fstec.ru/vul/2015-09905 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2009-2417 · Security Note
• http://curl.haxx.se/CVE-2009-2417/curl-7.19.5-CVE-2009-2417.patch · Patch
• http://curl.haxx.se/CVE-2009-2417/curl-7.18.1-CVE-2009-2417.patch · Patch