Vulnerability-Lookup

BDU:2015-03444 (CVE-2009-2409)

Vulnerability from fstec – Published: 2015-04-28 – Updated: 2016-11-28 – View on bdu.fstec.ru Fixed

Title

Уязвимости операционной системы Debian GNU/Linux, позволяющие удаленному злоумышленнику нарушить конфиденциальность, целостность и доступность защищаемой информации

Summary

Множественные уязвимости пакета libgnutls26-dbg операционной системы Debian GNU/Linux, эксплуатация которых может привести к нарушению конфиденциальности, целостности и доступности защищаемой информации. Эксплуатация уязвимостей может быть осуществлена удаленно

Severity

7.5 (High) CVSS 2.0


                      
                        AV:N/AC:L/Au:N/C:P/I:P/A:P

Status

Confirmed by the vendor

Exploitation

Spoofing

Incidents

Being clarified

Remediation

Being clarified

CWE

CWE-310 - Проблемы использования криптографии

Aliases

CVE-2009-2409, CVE-2009-2730, DSA-1935, ID:1402104

References

3 references

URL
http://www.debian.org/security/dsa-1935/
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2730
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2409

Impacted products

1 product from 1 vendor

Vendors

Сообщество свободного программного обеспечения

Products

Debian GNU/Linux

Versions

до 4 (Debian GNU/Linux)

Product types

Operating system

Mitigations

Проблема может быть решена обновлением операционной системы до следующих версий пакетов в зависимости от архитектуры: Debian GNU/Linux 4: ppc: libgnutls13-dbg - 1.4.4-3+etch5 libgnutls13 - 1.4.4-3+etch5 libgnutls-dev - 1.4.4-3+etch5 gnutls-bin - 1.4.4-3+etch5 s390x: libgnutls13 - 1.4.4-3+etch5 libgnutls-dev - 1.4.4-3+etch5 libgnutls13-dbg - 1.4.4-3+etch5 gnutls-bin - 1.4.4-3+etch5 i686: libgnutls-dev - 1.4.4-3+etch5 libgnutls13-dbg - 1.4.4-3+etch5 libgnutls13 - 1.4.4-3+etch5 gnutls-bin - 1.4.4-3+etch5 hppa: gnutls-bin - 1.4.4-3+etch5 libgnutls-dev - 1.4.4-3+etch5 libgnutls13-dbg - 1.4.4-3+etch5 libgnutls13 - 1.4.4-3+etch5 sparc: libgnutls-dev - 1.4.4-3+etch5 libgnutls13-dbg - 1.4.4-3+etch5 gnutls-bin - 1.4.4-3+etch5 libgnutls13 - 1.4.4-3+etch5 x86-64: libgnutls-dev - 1.4.4-3+etch5 libgnutls13-dbg - 1.4.4-3+etch5 gnutls-bin - 1.4.4-3+etch5 libgnutls13 - 1.4.4-3+etch5 alpha: libgnutls-dev - 1.4.4-3+etch5 gnutls-bin - 1.4.4-3+etch5 libgnutls13 - 1.4.4-3+etch5 libgnutls13-dbg - 1.4.4-3+etch5 ia64: libgnutls13-dbg - 1.4.4-3+etch5 gnutls-bin - 1.4.4-3+etch5 libgnutls13 - 1.4.4-3+etch5 libgnutls-dev - 1.4.4-3+etch5 mips: libgnutls13 - 1.4.4-3+etch5 gnutls-bin - 1.4.4-3+etch5 libgnutls-dev - 1.4.4-3+etch5 libgnutls13-dbg - 1.4.4-3+etch5 noarch: gnutls-doc - 1.4.4-3+etch5 mipsel: gnutls-bin - 1.4.4-3+etch5 libgnutls13-dbg - 1.4.4-3+etch5 libgnutls13 - 1.4.4-3+etch5 libgnutls-dev - 1.4.4-3+etch5 arm: libgnutls13-dbg - 1.4.4-3+etch5 gnutls-bin - 1.4.4-3+etch5 libgnutls-dev - 1.4.4-3+etch5 libgnutls13 - 1.4.4-3+etch5 Debian GNU/Linux 5: s390x: guile-gnutls - 2.4.2-6+lenny2 libgnutls26-dbg - 2.4.2-6+lenny2 libgnutls-dev - 2.4.2-6+lenny2 gnutls-bin - 2.4.2-6+lenny2 libgnutls26 - 2.4.2-6+lenny2 i686: libgnutls26 - 2.4.2-6+lenny2 libgnutls26-dbg - 2.4.2-6+lenny2 gnutls-bin - 2.4.2-6+lenny2 libgnutls-dev - 2.4.2-6+lenny2 guile-gnutls - 2.4.2-6+lenny2 hppa: libgnutls-dev - 2.4.2-6+lenny2 libgnutls26-dbg - 2.4.2-6+lenny2 gnutls-bin - 2.4.2-6+lenny2 guile-gnutls - 2.4.2-6+lenny2 libgnutls26 - 2.4.2-6+lenny2 sparc: libgnutls26 - 2.4.2-6+lenny2 libgnutls26-dbg - 2.4.2-6+lenny2 libgnutls-dev - 2.4.2-6+lenny2 guile-gnutls - 2.4.2-6+lenny2 gnutls-bin - 2.4.2-6+lenny2 x86-64: gnutls-bin - 2.4.2-6+lenny2 libgnutls-dev - 2.4.2-6+lenny2 libgnutls26-dbg - 2.4.2-6+lenny2 guile-gnutls - 2.4.2-6+lenny2 libgnutls26 - 2.4.2-6+lenny2 armel: libgnutls-dev - 2.4.2-6+lenny2 libgnutls26-dbg - 2.4.2-6+lenny2 gnutls-bin - 2.4.2-6+lenny2 libgnutls26 - 2.4.2-6+lenny2 guile-gnutls - 2.4.2-6+lenny2 alpha: guile-gnutls - 2.4.2-6+lenny2 libgnutls-dev - 2.4.2-6+lenny2 libgnutls26 - 2.4.2-6+lenny2 libgnutls26-dbg - 2.4.2-6+lenny2 gnutls-bin - 2.4.2-6+lenny2 ia64: libgnutls-dev - 2.4.2-6+lenny2 gnutls-bin - 2.4.2-6+lenny2 libgnutls26-dbg - 2.4.2-6+lenny2 libgnutls26 - 2.4.2-6+lenny2 mips: libgnutls-dev - 2.4.2-6+lenny2 guile-gnutls - 2.4.2-6+lenny2 libgnutls26-dbg - 2.4.2-6+lenny2 libgnutls26 - 2.4.2-6+lenny2 gnutls-bin - 2.4.2-6+lenny2 noarch: gnutls-doc - 2.4.2-6+lenny2 mipsel: libgnutls26 - 2.4.2-6+lenny2 gnutls-bin - 2.4.2-6+lenny2 libgnutls26-dbg - 2.4.2-6+lenny2 guile-gnutls - 2.4.2-6+lenny2 libgnutls-dev - 2.4.2-6+lenny2 arm: guile-gnutls - 2.4.2-6+lenny2 libgnutls26 - 2.4.2-6+lenny2 libgnutls26-dbg - 2.4.2-6+lenny2 gnutls-bin - 2.4.2-6+lenny2 libgnutls-dev - 2.4.2-6+lenny2

JSON

To clipboard

{
  "CVSS 2.0": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
  "CVSS 3.0": null,
  "CVSS 4.0": null,
  "remediation_\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": null,
  "remediation_\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435": null,
  "\u0412\u0435\u043d\u0434\u043e\u0440 \u041f\u041e": "\u0421\u043e\u043e\u0431\u0449\u0435\u0441\u0442\u0432\u043e \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u043e\u0433\u043e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f",
  "\u0412\u0435\u0440\u0441\u0438\u044f \u041f\u041e": "\u0434\u043e 4 (Debian GNU/Linux)",
  "\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e": "\u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0440\u0435\u0448\u0435\u043d\u0430 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435\u043c \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0434\u043e \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0445 \u0432\u0435\u0440\u0441\u0438\u0439 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0432 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0438 \u043e\u0442 \u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u044b:\nDebian GNU/Linux 4:\n\tppc:\n\t\tlibgnutls13-dbg - 1.4.4-3+etch5\n\t\tlibgnutls13 - 1.4.4-3+etch5\n\t\tlibgnutls-dev - 1.4.4-3+etch5\n\t\tgnutls-bin - 1.4.4-3+etch5\n\ts390x:\n\t\tlibgnutls13 - 1.4.4-3+etch5\n\t\tlibgnutls-dev - 1.4.4-3+etch5\n\t\tlibgnutls13-dbg - 1.4.4-3+etch5\n\t\tgnutls-bin - 1.4.4-3+etch5\n\ti686:\n\t\tlibgnutls-dev - 1.4.4-3+etch5\n\t\tlibgnutls13-dbg - 1.4.4-3+etch5\n\t\tlibgnutls13 - 1.4.4-3+etch5\n\t\tgnutls-bin - 1.4.4-3+etch5\n\thppa:\n\t\tgnutls-bin - 1.4.4-3+etch5\n\t\tlibgnutls-dev - 1.4.4-3+etch5\n\t\tlibgnutls13-dbg - 1.4.4-3+etch5\n\t\tlibgnutls13 - 1.4.4-3+etch5\n\tsparc:\n\t\tlibgnutls-dev - 1.4.4-3+etch5\n\t\tlibgnutls13-dbg - 1.4.4-3+etch5\n\t\tgnutls-bin - 1.4.4-3+etch5\n\t\tlibgnutls13 - 1.4.4-3+etch5\n\tx86-64:\n\t\tlibgnutls-dev - 1.4.4-3+etch5\n\t\tlibgnutls13-dbg - 1.4.4-3+etch5\n\t\tgnutls-bin - 1.4.4-3+etch5\n\t\tlibgnutls13 - 1.4.4-3+etch5\n\talpha:\n\t\tlibgnutls-dev - 1.4.4-3+etch5\n\t\tgnutls-bin - 1.4.4-3+etch5\n\t\tlibgnutls13 - 1.4.4-3+etch5\n\t\tlibgnutls13-dbg - 1.4.4-3+etch5\n\tia64:\n\t\tlibgnutls13-dbg - 1.4.4-3+etch5\n\t\tgnutls-bin - 1.4.4-3+etch5\n\t\tlibgnutls13 - 1.4.4-3+etch5\n\t\tlibgnutls-dev - 1.4.4-3+etch5\n\tmips:\n\t\tlibgnutls13 - 1.4.4-3+etch5\n\t\tgnutls-bin - 1.4.4-3+etch5\n\t\tlibgnutls-dev - 1.4.4-3+etch5\n\t\tlibgnutls13-dbg - 1.4.4-3+etch5\n\tnoarch:\n\t\tgnutls-doc - 1.4.4-3+etch5\n\tmipsel:\n\t\tgnutls-bin - 1.4.4-3+etch5\n\t\tlibgnutls13-dbg - 1.4.4-3+etch5\n\t\tlibgnutls13 - 1.4.4-3+etch5\n\t\tlibgnutls-dev - 1.4.4-3+etch5\n\tarm:\n\t\tlibgnutls13-dbg - 1.4.4-3+etch5\n\t\tgnutls-bin - 1.4.4-3+etch5\n\t\tlibgnutls-dev - 1.4.4-3+etch5\n\t\tlibgnutls13 - 1.4.4-3+etch5\nDebian GNU/Linux 5:\n\ts390x:\n\t\tguile-gnutls - 2.4.2-6+lenny2\n\t\tlibgnutls26-dbg - 2.4.2-6+lenny2\n\t\tlibgnutls-dev - 2.4.2-6+lenny2\n\t\tgnutls-bin - 2.4.2-6+lenny2\n\t\tlibgnutls26 - 2.4.2-6+lenny2\n\ti686:\n\t\tlibgnutls26 - 2.4.2-6+lenny2\n\t\tlibgnutls26-dbg - 2.4.2-6+lenny2\n\t\tgnutls-bin - 2.4.2-6+lenny2\n\t\tlibgnutls-dev - 2.4.2-6+lenny2\n\t\tguile-gnutls - 2.4.2-6+lenny2\n\thppa:\n\t\tlibgnutls-dev - 2.4.2-6+lenny2\n\t\tlibgnutls26-dbg - 2.4.2-6+lenny2\n\t\tgnutls-bin - 2.4.2-6+lenny2\n\t\tguile-gnutls - 2.4.2-6+lenny2\n\t\tlibgnutls26 - 2.4.2-6+lenny2\n\tsparc:\n\t\tlibgnutls26 - 2.4.2-6+lenny2\n\t\tlibgnutls26-dbg - 2.4.2-6+lenny2\n\t\tlibgnutls-dev - 2.4.2-6+lenny2\n\t\tguile-gnutls - 2.4.2-6+lenny2\n\t\tgnutls-bin - 2.4.2-6+lenny2\n\tx86-64:\n\t\tgnutls-bin - 2.4.2-6+lenny2\n\t\tlibgnutls-dev - 2.4.2-6+lenny2\n\t\tlibgnutls26-dbg - 2.4.2-6+lenny2\n\t\tguile-gnutls - 2.4.2-6+lenny2\n\t\tlibgnutls26 - 2.4.2-6+lenny2\n\tarmel:\n\t\tlibgnutls-dev - 2.4.2-6+lenny2\n\t\tlibgnutls26-dbg - 2.4.2-6+lenny2\n\t\tgnutls-bin - 2.4.2-6+lenny2\n\t\tlibgnutls26 - 2.4.2-6+lenny2\n\t\tguile-gnutls - 2.4.2-6+lenny2\n\talpha:\n\t\tguile-gnutls - 2.4.2-6+lenny2\n\t\tlibgnutls-dev - 2.4.2-6+lenny2\n\t\tlibgnutls26 - 2.4.2-6+lenny2\n\t\tlibgnutls26-dbg - 2.4.2-6+lenny2\n\t\tgnutls-bin - 2.4.2-6+lenny2\n\tia64:\n\t\tlibgnutls-dev - 2.4.2-6+lenny2\n\t\tgnutls-bin - 2.4.2-6+lenny2\n\t\tlibgnutls26-dbg - 2.4.2-6+lenny2\n\t\tlibgnutls26 - 2.4.2-6+lenny2\n\tmips:\n\t\tlibgnutls-dev - 2.4.2-6+lenny2\n\t\tguile-gnutls - 2.4.2-6+lenny2\n\t\tlibgnutls26-dbg - 2.4.2-6+lenny2\n\t\tlibgnutls26 - 2.4.2-6+lenny2\n\t\tgnutls-bin - 2.4.2-6+lenny2\n\tnoarch:\n\t\tgnutls-doc - 2.4.2-6+lenny2\n\tmipsel:\n\t\tlibgnutls26 - 2.4.2-6+lenny2\n\t\tgnutls-bin - 2.4.2-6+lenny2\n\t\tlibgnutls26-dbg - 2.4.2-6+lenny2\n\t\tguile-gnutls - 2.4.2-6+lenny2\n\t\tlibgnutls-dev - 2.4.2-6+lenny2\n\tarm:\n\t\tguile-gnutls - 2.4.2-6+lenny2\n\t\tlibgnutls26 - 2.4.2-6+lenny2\n\t\tlibgnutls26-dbg - 2.4.2-6+lenny2\n\t\tgnutls-bin - 2.4.2-6+lenny2\n\t\tlibgnutls-dev - 2.4.2-6+lenny2",
  "\u0414\u0430\u0442\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f": null,
  "\u0414\u0430\u0442\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f": "28.11.2016",
  "\u0414\u0430\u0442\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438": "28.04.2015",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "BDU:2015-03444",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "CVE-2009-2409, CVE-2009-2730, DSA-1935, ID:1402104",
  "\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430",
  "\u041a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
  "\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u041f\u041e": "Debian GNU/Linux",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u041e\u0421 \u0438 \u0442\u0438\u043f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b": null,
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b Debian\u00a0GNU/Linux, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0438\u0435 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u043c\u0443 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u044c \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u044c, \u0446\u0435\u043b\u043e\u0441\u0442\u043d\u043e\u0441\u0442\u044c \u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u0441\u0442\u044c \u0437\u0430\u0449\u0438\u0449\u0430\u0435\u043c\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438",
  "\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "\u041f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u043a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0438 (CWE-310)",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041c\u043d\u043e\u0436\u0435\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043f\u0430\u043a\u0435\u0442\u0430 libgnutls26-dbg \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b Debian\u00a0GNU/Linux, \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u043d\u0430\u0440\u0443\u0448\u0435\u043d\u0438\u044e \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u0438, \u0446\u0435\u043b\u043e\u0441\u0442\u043d\u043e\u0441\u0442\u0438 \u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e\u0441\u0442\u0438  \u0437\u0430\u0449\u0438\u0449\u0430\u0435\u043c\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u0435\u043d\u0430 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e",
  "\u041f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
  "\u041f\u0440\u043e\u0447\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f": null,
  "\u0421\u0432\u044f\u0437\u044c \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0418\u0411": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438": "\u041f\u043e\u0434\u043c\u0435\u043d\u0430 \u043f\u0440\u0438 \u0432\u0437\u0430\u0438\u043c\u043e\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0438",
  "\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438": "http://www.debian.org/security/dsa-1935/\nhttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2730\nhttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2409",
  "\u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u043c",
  "\u0422\u0438\u043f \u041f\u041e": "\u041e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u0430\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u0430",
  "\u0422\u0438\u043f \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "CWE-310",
  "\u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0412\u044b\u0441\u043e\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 2.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 7,5)"
}

CVE-2009-2409 (GCVE-0-2009-2409)

Vulnerability from cvelistv5 – Published: 2009-07-30 19:00 – Updated: 2024-08-07 05:52

Summary

The Network Security Services (NSS) library before 3.12.3, as used in Firefox; GnuTLS before 2.6.4 and 2.7.4; OpenSSL 0.9.8 through 0.9.8k; and other products support MD2 with X.509 certificates, which might allow remote attackers to spoof certificates by using MD2 design flaws to generate a hash collision in less than brute-force time. NOTE: the scope of this issue is currently limited because the amount of computation required is still large.

Severity

No CVSS data available.

CWE

Assigner

redhat redhat root

References

37 references

URL	Tags
http://secunia.com/advisories/36139	third-party-advisoryx_refsource_SECUNIA
http://secunia.com/advisories/36157	third-party-advisoryx_refsource_SECUNIA
http://www.mandriva.com/security/advisories?name=…	vendor-advisoryx_refsource_MANDRIVA
http://www.mandriva.com/security/advisories?name=…	vendor-advisoryx_refsource_MANDRIVA
https://www.debian.org/security/2009/dsa-1888	vendor-advisoryx_refsource_DEBIAN
https://oval.cisecurity.org/repository/search/def…	vdb-entrysignaturex_refsource_OVAL
http://security.gentoo.org/glsa/glsa-200911-02.xml	vendor-advisoryx_refsource_GENTOO
http://secunia.com/advisories/36434	third-party-advisoryx_refsource_SECUNIA
http://security.gentoo.org/glsa/glsa-200912-01.xml	vendor-advisoryx_refsource_GENTOO
http://www.securitytracker.com/id?1022631	vdb-entryx_refsource_SECTRACK
http://secunia.com/advisories/42467	third-party-advisoryx_refsource_SECUNIA
https://lists.balabit.com/pipermail/syslog-ng-ann…	mailing-listx_refsource_MLIST
http://www.redhat.com/support/errata/RHSA-2009-12…	vendor-advisoryx_refsource_REDHAT
http://www.securityfocus.com/archive/1/515055/100…	mailing-listx_refsource_BUGTRAQ
http://secunia.com/advisories/36669	third-party-advisoryx_refsource_SECUNIA
http://www.redhat.com/support/errata/RHSA-2009-14…	vendor-advisoryx_refsource_REDHAT
http://www.ubuntu.com/usn/usn-810-1	vendor-advisoryx_refsource_UBUNTU
https://oval.cisecurity.org/repository/search/def…	vdb-entrysignaturex_refsource_OVAL
http://www.mandriva.com/security/advisories?name=…	vendor-advisoryx_refsource_MANDRIVA
https://usn.ubuntu.com/810-2/	vendor-advisoryx_refsource_UBUNTU
http://java.sun.com/javase/6/webnotes/6u17.html	x_refsource_CONFIRM
https://oval.cisecurity.org/repository/search/def…	vdb-entrysignaturex_refsource_OVAL
https://lists.balabit.com/pipermail/syslog-ng-ann…	mailing-listx_refsource_MLIST
http://www.vupen.com/english/advisories/2010/3126	vdb-entryx_refsource_VUPEN
https://rhn.redhat.com/errata/RHSA-2010-0095.html	vendor-advisoryx_refsource_REDHAT
http://www.vupen.com/english/advisories/2009/3184	vdb-entryx_refsource_VUPEN
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2…	x_refsource_CONFIRM
http://java.sun.com/j2se/1.5.0/ReleaseNotes.html	x_refsource_CONFIRM
http://www.vmware.com/security/advisories/VMSA-20…	x_refsource_CONFIRM
https://oval.cisecurity.org/repository/search/def…	vdb-entrysignaturex_refsource_OVAL
http://lists.apple.com/archives/security-announce…	vendor-advisoryx_refsource_APPLE
http://www.mandriva.com/security/advisories?name=…	vendor-advisoryx_refsource_MANDRIVA
http://secunia.com/advisories/37386	third-party-advisoryx_refsource_SECUNIA
http://www.vupen.com/english/advisories/2009/2085	vdb-entryx_refsource_VUPEN
http://www.debian.org/security/2009/dsa-1874	vendor-advisoryx_refsource_DEBIAN
http://secunia.com/advisories/36739	third-party-advisoryx_refsource_SECUNIA
http://support.apple.com/kb/HT3937	x_refsource_CONFIRM

Date Public

2009-07-29 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T05:52:14.899Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "36139",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/36139"
          },
          {
            "name": "36157",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/36157"
          },
          {
            "name": "MDVSA-2009:197",
            "tags": [
              "vendor-advisory",
              "x_refsource_MANDRIVA",
              "x_transferred"
            ],
            "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:197"
          },
          {
            "name": "MDVSA-2009:216",
            "tags": [
              "vendor-advisory",
              "x_refsource_MANDRIVA",
              "x_transferred"
            ],
            "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:216"
          },
          {
            "name": "DSA-1888",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2009/dsa-1888"
          },
          {
            "name": "oval:org.mitre.oval:def:8594",
            "tags": [
              "vdb-entry",
              "signature",
              "x_refsource_OVAL",
              "x_transferred"
            ],
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8594"
          },
          {
            "name": "GLSA-200911-02",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "http://security.gentoo.org/glsa/glsa-200911-02.xml"
          },
          {
            "name": "36434",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/36434"
          },
          {
            "name": "GLSA-200912-01",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "http://security.gentoo.org/glsa/glsa-200912-01.xml"
          },
          {
            "name": "1022631",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id?1022631"
          },
          {
            "name": "42467",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/42467"
          },
          {
            "name": "[syslog-ng-announce] 20110110 syslog-ng Premium Edition 3.0.6a has been released",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.balabit.com/pipermail/syslog-ng-announce/2011-January/000101.html"
          },
          {
            "name": "RHSA-2009:1207",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://www.redhat.com/support/errata/RHSA-2009-1207.html"
          },
          {
            "name": "20101207 VMSA-2010-0019 VMware ESX third party updates for Service Console",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/515055/100/0/threaded"
          },
          {
            "name": "36669",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/36669"
          },
          {
            "name": "RHSA-2009:1432",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://www.redhat.com/support/errata/RHSA-2009-1432.html"
          },
          {
            "name": "USN-810-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "http://www.ubuntu.com/usn/usn-810-1"
          },
          {
            "name": "oval:org.mitre.oval:def:10763",
            "tags": [
              "vdb-entry",
              "signature",
              "x_refsource_OVAL",
              "x_transferred"
            ],
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10763"
          },
          {
            "name": "MDVSA-2009:258",
            "tags": [
              "vendor-advisory",
              "x_refsource_MANDRIVA",
              "x_transferred"
            ],
            "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:258"
          },
          {
            "name": "USN-810-2",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/810-2/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://java.sun.com/javase/6/webnotes/6u17.html"
          },
          {
            "name": "oval:org.mitre.oval:def:7155",
            "tags": [
              "vdb-entry",
              "signature",
              "x_refsource_OVAL",
              "x_transferred"
            ],
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7155"
          },
          {
            "name": "[syslog-ng-announce] 20110110 syslog-ng Premium Edition 3.2.1a has been released",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.balabit.com/pipermail/syslog-ng-announce/2011-January/000102.html"
          },
          {
            "name": "ADV-2010-3126",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2010/3126"
          },
          {
            "name": "RHSA-2010:0095",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://rhn.redhat.com/errata/RHSA-2010-0095.html"
          },
          {
            "name": "ADV-2009-3184",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2009/3184"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2009-2409"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://java.sun.com/j2se/1.5.0/ReleaseNotes.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.vmware.com/security/advisories/VMSA-2010-0019.html"
          },
          {
            "name": "oval:org.mitre.oval:def:6631",
            "tags": [
              "vdb-entry",
              "signature",
              "x_refsource_OVAL",
              "x_transferred"
            ],
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6631"
          },
          {
            "name": "APPLE-SA-2009-11-09-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_APPLE",
              "x_transferred"
            ],
            "url": "http://lists.apple.com/archives/security-announce/2009/Nov/msg00000.html"
          },
          {
            "name": "MDVSA-2010:084",
            "tags": [
              "vendor-advisory",
              "x_refsource_MANDRIVA",
              "x_transferred"
            ],
            "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2010:084"
          },
          {
            "name": "37386",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/37386"
          },
          {
            "name": "ADV-2009-2085",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2009/2085"
          },
          {
            "name": "DSA-1874",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "http://www.debian.org/security/2009/dsa-1874"
          },
          {
            "name": "36739",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/36739"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://support.apple.com/kb/HT3937"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2009-07-29T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "The Network Security Services (NSS) library before 3.12.3, as used in Firefox; GnuTLS before 2.6.4 and 2.7.4; OpenSSL 0.9.8 through 0.9.8k; and other products support MD2 with X.509 certificates, which might allow remote attackers to spoof certificates by using MD2 design flaws to generate a hash collision in less than brute-force time.  NOTE: the scope of this issue is currently limited because the amount of computation required is still large."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-10T18:57:01.000Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "36139",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/36139"
        },
        {
          "name": "36157",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/36157"
        },
        {
          "name": "MDVSA-2009:197",
          "tags": [
            "vendor-advisory",
            "x_refsource_MANDRIVA"
          ],
          "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:197"
        },
        {
          "name": "MDVSA-2009:216",
          "tags": [
            "vendor-advisory",
            "x_refsource_MANDRIVA"
          ],
          "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:216"
        },
        {
          "name": "DSA-1888",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2009/dsa-1888"
        },
        {
          "name": "oval:org.mitre.oval:def:8594",
          "tags": [
            "vdb-entry",
            "signature",
            "x_refsource_OVAL"
          ],
          "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8594"
        },
        {
          "name": "GLSA-200911-02",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "http://security.gentoo.org/glsa/glsa-200911-02.xml"
        },
        {
          "name": "36434",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/36434"
        },
        {
          "name": "GLSA-200912-01",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "http://security.gentoo.org/glsa/glsa-200912-01.xml"
        },
        {
          "name": "1022631",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id?1022631"
        },
        {
          "name": "42467",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/42467"
        },
        {
          "name": "[syslog-ng-announce] 20110110 syslog-ng Premium Edition 3.0.6a has been released",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.balabit.com/pipermail/syslog-ng-announce/2011-January/000101.html"
        },
        {
          "name": "RHSA-2009:1207",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://www.redhat.com/support/errata/RHSA-2009-1207.html"
        },
        {
          "name": "20101207 VMSA-2010-0019 VMware ESX third party updates for Service Console",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/515055/100/0/threaded"
        },
        {
          "name": "36669",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/36669"
        },
        {
          "name": "RHSA-2009:1432",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://www.redhat.com/support/errata/RHSA-2009-1432.html"
        },
        {
          "name": "USN-810-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "http://www.ubuntu.com/usn/usn-810-1"
        },
        {
          "name": "oval:org.mitre.oval:def:10763",
          "tags": [
            "vdb-entry",
            "signature",
            "x_refsource_OVAL"
          ],
          "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10763"
        },
        {
          "name": "MDVSA-2009:258",
          "tags": [
            "vendor-advisory",
            "x_refsource_MANDRIVA"
          ],
          "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2009:258"
        },
        {
          "name": "USN-810-2",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/810-2/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://java.sun.com/javase/6/webnotes/6u17.html"
        },
        {
          "name": "oval:org.mitre.oval:def:7155",
          "tags": [
            "vdb-entry",
            "signature",
            "x_refsource_OVAL"
          ],
          "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7155"
        },
        {
          "name": "[syslog-ng-announce] 20110110 syslog-ng Premium Edition 3.2.1a has been released",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.balabit.com/pipermail/syslog-ng-announce/2011-January/000102.html"
        },
        {
          "name": "ADV-2010-3126",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2010/3126"
        },
        {
          "name": "RHSA-2010:0095",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://rhn.redhat.com/errata/RHSA-2010-0095.html"
        },
        {
          "name": "ADV-2009-3184",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2009/3184"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2009-2409"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://java.sun.com/j2se/1.5.0/ReleaseNotes.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.vmware.com/security/advisories/VMSA-2010-0019.html"
        },
        {
          "name": "oval:org.mitre.oval:def:6631",
          "tags": [
            "vdb-entry",
            "signature",
            "x_refsource_OVAL"
          ],
          "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6631"
        },
        {
          "name": "APPLE-SA-2009-11-09-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_APPLE"
          ],
          "url": "http://lists.apple.com/archives/security-announce/2009/Nov/msg00000.html"
        },
        {
          "name": "MDVSA-2010:084",
          "tags": [
            "vendor-advisory",
            "x_refsource_MANDRIVA"
          ],
          "url": "http://www.mandriva.com/security/advisories?name=MDVSA-2010:084"
        },
        {
          "name": "37386",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/37386"
        },
        {
          "name": "ADV-2009-2085",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2009/2085"
        },
        {
          "name": "DSA-1874",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "http://www.debian.org/security/2009/dsa-1874"
        },
        {
          "name": "36739",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/36739"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://support.apple.com/kb/HT3937"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2009-2409",
    "datePublished": "2009-07-30T19:00:00.000Z",
    "dateReserved": "2009-07-09T00:00:00.000Z",
    "dateUpdated": "2024-08-07T05:52:14.899Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2009-2730 (GCVE-0-2009-2730)

Vulnerability from cvelistv5 – Published: 2009-08-12 10:00 – Updated: 2024-08-07 05:59

Summary

libgnutls in GnuTLS before 2.8.2 does not properly handle a '\0' character in a domain name in the subject's (1) Common Name (CN) or (2) Subject Alternative Name (SAN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority.

Severity

No CVSS data available.

CWE

Assigner

mitre mitre root

References

13 references

URL	Tags
https://oval.cisecurity.org/repository/search/def…	vdb-entrysignaturex_refsource_OVAL
http://www.securitytracker.com/id?1022777	vdb-entryx_refsource_SECTRACK
http://www.vmware.com/security/advisories/VMSA-20…	x_refsource_CONFIRM
http://www.openwall.com/lists/oss-security/2009/08/14/6	mailing-listx_refsource_MLIST
http://www.redhat.com/support/errata/RHSA-2009-12…	vendor-advisoryx_refsource_REDHAT
http://lists.opensuse.org/opensuse-security-annou…	vendor-advisoryx_refsource_SUSE
http://secunia.com/advisories/36496	third-party-advisoryx_refsource_SECUNIA
https://oval.cisecurity.org/repository/search/def…	vdb-entrysignaturex_refsource_OVAL
http://secunia.com/advisories/36266	third-party-advisoryx_refsource_SECUNIA
http://www.securityfocus.com/archive/1/507985/100…	mailing-listx_refsource_BUGTRAQ
https://exchange.xforce.ibmcloud.com/vulnerabilit…	vdb-entryx_refsource_XF
https://rhn.redhat.com/errata/RHSA-2010-0095.html	vendor-advisoryx_refsource_REDHAT
http://article.gmane.org/gmane.network.gnutls.gen…	x_refsource_CONFIRM

Date Public

2009-08-11 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T05:59:57.016Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "oval:org.mitre.oval:def:8409",
            "tags": [
              "vdb-entry",
              "signature",
              "x_refsource_OVAL",
              "x_transferred"
            ],
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8409"
          },
          {
            "name": "1022777",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id?1022777"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.vmware.com/security/advisories/VMSA-2009-0016.html"
          },
          {
            "name": "[oss-security] 20090814 GnuTLS CVE-2009-2730 Patches (Was Re: GnuTLS 2.8.2)",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2009/08/14/6"
          },
          {
            "name": "RHSA-2009:1232",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "http://www.redhat.com/support/errata/RHSA-2009-1232.html"
          },
          {
            "name": "SUSE-SR:2009:015",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2009-09/msg00001.html"
          },
          {
            "name": "36496",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/36496"
          },
          {
            "name": "oval:org.mitre.oval:def:10778",
            "tags": [
              "vdb-entry",
              "signature",
              "x_refsource_OVAL",
              "x_transferred"
            ],
            "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10778"
          },
          {
            "name": "36266",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/36266"
          },
          {
            "name": "20091120 VMSA-2009-0016 VMware vCenter and ESX update release and vMA patch release address multiple security issue in third party components",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/507985/100/0/threaded"
          },
          {
            "name": "gnutls-cn-san-security-bypass(52404)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/52404"
          },
          {
            "name": "RHSA-2010:0095",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://rhn.redhat.com/errata/RHSA-2010-0095.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://article.gmane.org/gmane.network.gnutls.general/1733"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2009-08-11T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "libgnutls in GnuTLS before 2.8.2 does not properly handle a \u0027\\0\u0027 character in a domain name in the subject\u0027s (1) Common Name (CN) or (2) Subject Alternative Name (SAN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-10T18:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "oval:org.mitre.oval:def:8409",
          "tags": [
            "vdb-entry",
            "signature",
            "x_refsource_OVAL"
          ],
          "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8409"
        },
        {
          "name": "1022777",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id?1022777"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.vmware.com/security/advisories/VMSA-2009-0016.html"
        },
        {
          "name": "[oss-security] 20090814 GnuTLS CVE-2009-2730 Patches (Was Re: GnuTLS 2.8.2)",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2009/08/14/6"
        },
        {
          "name": "RHSA-2009:1232",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "http://www.redhat.com/support/errata/RHSA-2009-1232.html"
        },
        {
          "name": "SUSE-SR:2009:015",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2009-09/msg00001.html"
        },
        {
          "name": "36496",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/36496"
        },
        {
          "name": "oval:org.mitre.oval:def:10778",
          "tags": [
            "vdb-entry",
            "signature",
            "x_refsource_OVAL"
          ],
          "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10778"
        },
        {
          "name": "36266",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/36266"
        },
        {
          "name": "20091120 VMSA-2009-0016 VMware vCenter and ESX update release and vMA patch release address multiple security issue in third party components",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/507985/100/0/threaded"
        },
        {
          "name": "gnutls-cn-san-security-bypass(52404)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/52404"
        },
        {
          "name": "RHSA-2010:0095",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://rhn.redhat.com/errata/RHSA-2010-0095.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://article.gmane.org/gmane.network.gnutls.general/1733"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2009-2730",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "libgnutls in GnuTLS before 2.8.2 does not properly handle a \u0027\\0\u0027 character in a domain name in the subject\u0027s (1) Common Name (CN) or (2) Subject Alternative Name (SAN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "oval:org.mitre.oval:def:8409",
              "refsource": "OVAL",
              "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8409"
            },
            {
              "name": "1022777",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id?1022777"
            },
            {
              "name": "http://www.vmware.com/security/advisories/VMSA-2009-0016.html",
              "refsource": "CONFIRM",
              "url": "http://www.vmware.com/security/advisories/VMSA-2009-0016.html"
            },
            {
              "name": "[oss-security] 20090814 GnuTLS CVE-2009-2730 Patches (Was Re: GnuTLS 2.8.2)",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2009/08/14/6"
            },
            {
              "name": "RHSA-2009:1232",
              "refsource": "REDHAT",
              "url": "http://www.redhat.com/support/errata/RHSA-2009-1232.html"
            },
            {
              "name": "SUSE-SR:2009:015",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2009-09/msg00001.html"
            },
            {
              "name": "36496",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/36496"
            },
            {
              "name": "oval:org.mitre.oval:def:10778",
              "refsource": "OVAL",
              "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10778"
            },
            {
              "name": "36266",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/36266"
            },
            {
              "name": "20091120 VMSA-2009-0016 VMware vCenter and ESX update release and vMA patch release address multiple security issue in third party components",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/507985/100/0/threaded"
            },
            {
              "name": "gnutls-cn-san-security-bypass(52404)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/52404"
            },
            {
              "name": "RHSA-2010:0095",
              "refsource": "REDHAT",
              "url": "https://rhn.redhat.com/errata/RHSA-2010-0095.html"
            },
            {
              "name": "http://article.gmane.org/gmane.network.gnutls.general/1733",
              "refsource": "CONFIRM",
              "url": "http://article.gmane.org/gmane.network.gnutls.general/1733"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2009-2730",
    "datePublished": "2009-08-12T10:00:00.000Z",
    "dateReserved": "2009-08-10T00:00:00.000Z",
    "dateUpdated": "2024-08-07T05:59:57.016Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

BDU:2015-03444 (CVE-2009-2409)

CVE-2009-2409 (GCVE-0-2009-2409)

CVE-2009-2730 (GCVE-0-2009-2730)

Tags

Sightings

Nomenclature

Related by attack behaviour