CVE-2009-2702 KDE KSSL in kdelibs 3.5.4, 4.2.4, and 4.3 does not properly handle a '\0' character in a domain name in the Subject Alternative Name field of an X.509 certificate, which allows man-in-the-middle attac...
HighCVSS 7.5
EPSS 1.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
KDE KSSL in kdelibs 3.5.4, 4.2.4, and 4.3 does not properly handle a '\0' character in a domain name in the Subject Alternative Name field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| kdelibs | = 3.5.4 | No fix listed |
| kdelibs | = 4.2.4 | No fix listed |
| kdelibs | = 4.3 | No fix listed |
| debian/kde4libs(Debian:10) | < 4:4.3.2-1 | 4:4.3.2-1 |
References
- 36468 third-party-advisory vendor-advisory
- MDVSA-2009:330 vendor-advisory
- MDVSA-2011:162 vendor-advisory
- ADV-2009-2532 vdb-entry vendor-advisory
- bugzilla.redhat.com issue-tracking