CVE-2009-3767
published 2009-10-23CVE-2009-3767: libraries/libldap/tls_o.c in OpenLDAP 2.2 and 2.4, and possibly other versions, when OpenSSL is used, does not properly handle a '\0' character in a domain…
PriorityP423medium4.3CVSS 2.0
AVNACMAuNCNIPAN
EPSS
3.09%
86.3th percentile
libraries/libldap/tls_o.c in OpenLDAP 2.2 and 2.4, and possibly other versions, when OpenSSL is used, does not properly handle a '\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | mac_os_x | < 10.6.2 | 10.6.2 |
| debian | openldap | < openldap 2.4.17-2.1 (bookworm) | openldap 2.4.17-2.1 (bookworm) |
| fedoraproject | fedora | — | — |
| msrc | cbl_mariner_1.0_arm | — | — |
| msrc | cbl_mariner_1.0_x64 | — | — |
| openldap | openldap | < 2.4.18 | 2.4.18 |
| openldap | openldap | >= 0 < 2.4.17-2.1 | 2.4.17-2.1 |
| openldap | openldap | >= 0 < 2.4.17-2.1 | 2.4.17-2.1 |
| openldap | openldap | >= 0 < 2.4.17-2.1 | 2.4.17-2.1 |
| openldap | openldap | >= 0 < 2.4.17-2.1 | 2.4.17-2.1 |
CVSS provenance
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
osv5.9MEDIUM
vendor_debian5.9LOW
vendor_redhat5.9MEDIUM
vendor_msrc4.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-hc4m-gmh3-4vxp: libraries/libldap/tls_o
ghsa_unreviewed·2022-05-02·CVSS 5.9
CVE-2009-3767 [MEDIUM] CWE-295 GHSA-hc4m-gmh3-4vxp: libraries/libldap/tls_o
libraries/libldap/tls_o.c in OpenLDAP 2.2 and 2.4, and possibly other versions, when OpenSSL is used, does not properly handle a '\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.
OSV
CVE-2009-3767: libraries/libldap/tls_o
osv·2009-10-23·CVSS 5.9
CVE-2009-3767 [MEDIUM] CVE-2009-3767: libraries/libldap/tls_o
libraries/libldap/tls_o.c in OpenLDAP 2.2 and 2.4, and possibly other versions, when OpenSSL is used, does not properly handle a '\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.
Microsoft
CVE-2009-3767: NIST NVD Details: https://nvd
vendor_msrc·2020-09-08·CVSS 4.3
CVE-2009-3767 [MEDIUM] CVE-2009-3767: NIST NVD Details: https://nvd
NIST NVD Details: https://nvd.nist.gov/vuln/detail/CVE-2009-3767
Mariner: Mariner
[email protected]: [email protected]
Exploit Status: DOS:N/A
Remediation: openldap
Remediation: openssl
Ubuntu
OpenLDAP vulnerability
vendor_ubuntu·2009-11-12
CVE-2009-3767 OpenLDAP vulnerability
Title: OpenLDAP vulnerability
Summary: OpenLDAP vulnerability
It was discovered that OpenLDAP did not correctly handle SSL certificates
with zero bytes in the Common Name. A remote attacker could exploit this to
perform a machine-in-the-middle attack to view sensitive information or alter
encrypted communications.
Instructions: In general, a standard system upgrade is sufficient to effect the
necessary changes.
Red Hat
OpenLDAP: Doesn't properly handle NULL character in subject Common Name
vendor_redhat·2009-08-10·CVSS 5.9
CVE-2009-3767 [MEDIUM] OpenLDAP: Doesn't properly handle NULL character in subject Common Name
OpenLDAP: Doesn't properly handle NULL character in subject Common Name
libraries/libldap/tls_o.c in OpenLDAP 2.2 and 2.4, and possibly other versions, when OpenSSL is used, does not properly handle a '\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.
Statement: This issue was addressed in the openldap packages as shipped with Red Hat Enterprise Linux 5 and 4 via: https://rhn.redhat.com/errata/RHSA-2010-0198.html and https://rhn.redhat.com/errata/RHSA-2010-0543.html respectively.
The Red Hat Security Response Team has rated this issue as having moderate security imp
Debian
CVE-2009-3767: openldap - libraries/libldap/tls_o.c in OpenLDAP 2.2 and 2.4, and possibly other versions, ...
vendor_debian·2009·CVSS 5.9
CVE-2009-3767 [MEDIUM] CVE-2009-3767: openldap - libraries/libldap/tls_o.c in OpenLDAP 2.2 and 2.4, and possibly other versions, ...
libraries/libldap/tls_o.c in OpenLDAP 2.2 and 2.4, and possibly other versions, when OpenSSL is used, does not properly handle a '\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.
Scope: local
bookworm: resolved (fixed in 2.4.17-2.1)
bullseye: resolved (fixed in 2.4.17-2.1)
forky: resolved (fixed in 2.4.17-2.1)
sid: resolved (fixed in 2.4.17-2.1)
trixie: resolved (fixed in 2.4.17-2.1)
No detection rules found.
No public exploits indexed.
http://lists.apple.com/archives/security-announce/2009/Nov/msg00000.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2010-March/036138.htmlhttp://lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.htmlhttp://marc.info/?l=oss-security&m=125198917018936&w=2http://marc.info/?l=oss-security&m=125369675820512&w=2http://secunia.com/advisories/38769http://secunia.com/advisories/40677http://security.gentoo.org/glsa/glsa-201406-36.xmlhttp://support.apple.com/kb/HT3937http://www.openldap.org/devel/cvsweb.cgi/libraries/libldap/tls_o.c.diff?r1=1.8&r2=1.11&f=hhttp://www.redhat.com/support/errata/RHSA-2010-0543.htmlhttp://www.redhat.com/support/errata/RHSA-2011-0896.htmlhttp://www.vupen.com/english/advisories/2009/3056http://www.vupen.com/english/advisories/2010/1858https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11178https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7274http://lists.apple.com/archives/security-announce/2009/Nov/msg00000.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2010-March/036138.htmlhttp://lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.htmlhttp://marc.info/?l=oss-security&m=125198917018936&w=2http://marc.info/?l=oss-security&m=125369675820512&w=2http://secunia.com/advisories/38769http://secunia.com/advisories/40677http://security.gentoo.org/glsa/glsa-201406-36.xmlhttp://support.apple.com/kb/HT3937http://www.openldap.org/devel/cvsweb.cgi/libraries/libldap/tls_o.c.diff?r1=1.8&r2=1.11&f=hhttp://www.redhat.com/support/errata/RHSA-2010-0543.htmlhttp://www.redhat.com/support/errata/RHSA-2011-0896.htmlhttp://www.vupen.com/english/advisories/2009/3056http://www.vupen.com/english/advisories/2010/1858https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11178https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7274
2009-10-23
Published