FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

CVE-2009-2730

This CVE name corresponds to:

Entered	Topic
2009-08-17	GnuTLS -- improper SSL certificate verification

The following information is adapted from the Common Vulnerabilities and Exposures (CVE) project. CVE and the CVE logo are trademarks of The MITRE Corporation. CVE content is Copyright 2005, The MITRE Corporation.

CVE-2009-2730 at cve.mitre.org

Details

Type	Candidate
Name	CVE-2009-2730
Phase	Assigned(20090810)

Description

libgnutls in GnuTLS before 2.8.2 does not properly handle a '\0' character in a domain name in the subject's (1) Common Name (CN) or (2) Subject Alternative Name (SAN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority.

References

Source	Reference
BUGTRAQ	20091120 VMSA-2009-0016 VMware vCenter and ESX update release and vMA patch release address multiple security issue in third party components
MLIST	[oss-security] 20090814 GnuTLS CVE-2009-2730 Patches (Was Re: GnuTLS 2.8.2)
CONFIRM	http://article.gmane.org/gmane.network.gnutls.general/1733
CONFIRM	http://www.vmware.com/security/advisories/VMSA-2009-0016.html
REDHAT	RHSA-2009:1232
REDHAT	RHSA-2010:0095
SUSE	SUSE-SR:2009:015
OVAL	oval:org.mitre.oval:def:10778
OVAL	oval:org.mitre.oval:def:8409
SECTRACK	1022777
SECUNIA	36266
SECUNIA	36496
XF	gnutls-cn-san-security-bypass(52404)