PT-2009-6718 · Gnu+1 · Libgnutls26-Dbg+3

Published 1970-01-01 · Updated 2018-10-10 · CVE-2009-2730

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions GnuTLS versions prior to 2.8.2 GnuTLS versions prior to 2.10.0 GnuTLS versions prior to 2.12.18 libgnutls26 versions (affected versions not specified) libgnutls26-dbg versions (affected versions not specified)

Description The issue affects the confidentiality, integrity, and availability of protected information. It can be exploited remotely. The problem is related to the handling of a '0' character in a domain name in the subject's Common Name (CN) or Subject Alternative Name (SAN) field of an X.509 certificate, allowing man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority.

Recommendations For GnuTLS versions prior to 2.8.2, update to version 2.8.2 or later. For GnuTLS versions prior to 2.10.0, update to version 2.10.0 or later. For GnuTLS versions prior to 2.12.18, update to version 2.12.18 or later. For libgnutls26 and libgnutls26-dbg, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-310

Related Identifiers

BDU:2015-03443

BDU:2015-03444

BDU:2015-09417

BDU:2015-09647

CVE-2009-2730

DSA-1935-1

RHSA-2009:1232

RHSA-2009_1232

Affected Products

Gnutls

Red Hat

Libgnutls26

Libgnutls26-Dbg

References · 25

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2730 · Security Note
• https://bdu.fstec.ru/vul/2015-09647 · Security Note
• http://article.gmane.org/gmane.network.gnutls.general/1733 · Vendor Advisory
• http://secunia.com/advisories/36266 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2009-09/msg00001.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-03444 · Security Note
• https://rhn.redhat.com/errata/RHSA-2010-0095.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-2730 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2409 · Security Note
• https://bdu.fstec.ru/vul/2015-03443 · Security Note
• http://redhat.com/support/errata/RHSA-2009-1232.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-09417 · Security Note
• http://security.gentoo.org/glsa/glsa-201206-18.xml · Note
• http://openwall.com/lists/oss-security/2009/08/14/6 · Note
• http://securityfocus.com/archive/1/507985/100/0/threaded · Note