FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

CVE-2009-2666

This CVE name corresponds to:

Entered	Topic
2009-08-11	fetchmail -- improper SSL certificate subject verification

The following information is adapted from the Common Vulnerabilities and Exposures (CVE) project. CVE and the CVE logo are trademarks of The MITRE Corporation. CVE content is Copyright 2005, The MITRE Corporation.

CVE-2009-2666 at cve.mitre.org

Details

Type	Candidate
Name	CVE-2009-2666
Phase	Assigned(20090805)

Description

socket.c in fetchmail before 6.3.11 does not properly handle a '\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.

References

Source	Reference
BUGTRAQ	20090806 fetchmail security announcement fetchmail-SA-2009-01 (CVE-2009-2666)
MLIST	[oss-security] 20090805 Re: CVE request: fetchmail <= 6.3.10 SSL certificate
CONFIRM	http://fetchmail.berlios.de/fetchmail-SA-2009-01.txt
CONFIRM	http://support.apple.com/kb/HT3937
APPLE	APPLE-SA-2009-11-09-1
DEBIAN	DSA-1852
MANDRIVA	MDVSA-2009:201
SLACKWARE	SSA:2009-218-01
BID	35951
OSVDB	56855
OVAL	oval:org.mitre.oval:def:11059
SECTRACK	1022679
SECUNIA	36175
SECUNIA	36179
SECUNIA	36236
VUPEN	ADV-2009-2155
VUPEN	ADV-2009-3184