PT-2009-2819 · Tenable+1 · Nessus Attack Scripting Language Library+1

Jan Lieskovsky · Published 2009-01-15 · Updated 2024-08-07 · CVE-2009-0125

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Nessus Attack Scripting Language library (aka libnasl) version 2.2.11

Description The issue concerns a potential problem in the Nessus Attack Scripting Language library where the return value from the OpenSSL DSA do verify function is not properly checked. This could theoretically allow remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature. However, the upstream vendor has disputed this issue, stating that although the function is misused, it has no security ramifications.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2009-0125

Affected Products

Nessus Attack Scripting Language Library

Openssl

References · 8

• 🔥 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=511517 · Exploit
• 🔥 https://bugzilla.redhat.com/show_bug.cgi?id=479655 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-0125 · Security Note
• http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00000.html · Vendor Advisory
• http://openwall.com/lists/oss-security/2009/01/12/4 · Note
• https://t.me/cvenotify/89572 · Telegram Post
• http://cvs.fedoraproject.org/viewvc/rpms/libnasl/F-10/libnasl.spec?r1=1.16&r2=1.17 · Note
• http://attrition.org/pipermail/vim/2009-January/002133.html · Note