FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

CVE-2009-1417

This CVE name corresponds to:

Entered	Topic
2009-08-17	GnuTLS -- multiple vulnerabilities

The following information is adapted from the Common Vulnerabilities and Exposures (CVE) project. CVE and the CVE logo are trademarks of The MITRE Corporation. CVE content is Copyright 2005, The MITRE Corporation.

CVE-2009-1417 at cve.mitre.org

Details

Type	Candidate
Name	CVE-2009-1417
Phase	Assigned(20090424)

Description

gnutls-cli in GnuTLS before 2.6.6 does not verify the activation and expiration times of X.509 certificates, which allows remote attackers to successfully present a certificate that is (1) not yet valid or (2) no longer valid, related to lack of time checks in the _gnutls_x509_verify_certificate function in lib/x509/verify.c in libgnutls_x509, as used by (a) Exim, (b) OpenLDAP, and (c) libsoup.

References

Source	Reference
MLIST	[gnutls-devel] 20090430 Certificate expiration not checked by gnutls-cli [GNUTLS-SA-2009-3] [CVE-2009-1417]
GENTOO	GLSA-200905-04
MANDRIVA	MDVSA-2009:116
BID	34783
SECTRACK	1022159
SECUNIA	34842
SECUNIA	35211
VUPEN	ADV-2009-1218
XF	gnutls-gnutlscli-spoofing(50261)