Vulnerability CVE-2008-2809


Published: 2008-07-08   Modified: 2012-02-12

Description:
Mozilla 1.9 M8 and earlier, Mozilla Firefox 2 before 2.0.0.15, SeaMonkey 1.1.5 and other versions before 1.1.10, Netscape 9.0, and other Mozilla-based web browsers, when a user accepts an SSL server certificate on the basis of the CN domain name in the DN field, regard the certificate as also accepted for all domain names in subjectAltName:dNSName fields, which makes it easier for remote attackers to trick a user into accepting an invalid certificate for a spoofed web site.

See advisories in our WLB2 database:
Topic
Author
Date
Med.
Certificate spoofing issue with Mozilla, Konqueror, Safari 2
Nils Toedtmann
28.12.2007

Type:

CWE-20

(Improper Input Validation)

Vendor: Netscape
Product: Navigator 
Version: 9.0;
Vendor: Mozilla
Product: Firefox 
Version:
2.0.0.9
2.0.0.8
2.0.0.7
2.0.0.6
2.0.0.5
2.0.0.4
2.0.0.3
2.0.0.2
2.0.0.14
2.0.0.13
2.0.0.12
2.0.0.11
2.0.0.10
2.0.0.1
Product: Geckb 
Version: 1.9;
Product: Seamonkey 
Version: 1.1.5; 1.0.9;

CVSS2 => (AV:N/AC:H/Au:N/C:N/I:P/A:P)

CVSS Base Score
Impact Subscore
Exploitability Subscore
4/10
4.9/10
4.9/10
Exploit range
Attack complexity
Authentication
Remote
High
No required
Confidentiality impact
Integrity impact
Availability impact
None
Partial
Partial

 References:
https://www.redhat.com/archives/fedora-package-announce/2008-July/msg00295.html
https://www.redhat.com/archives/fedora-package-announce/2008-July/msg00288.html
https://www.redhat.com/archives/fedora-package-announce/2008-July/msg00207.html
https://www.redhat.com/archives/fedora-package-announce/2008-August/msg00144.html
https://www.redhat.com/archives/fedora-package-announce/2008-August/msg00125.html
https://issues.rpath.com/browse/RPL-2646
https://bugzilla.mozilla.org/show_bug.cgi?id=402347
https://bugzilla.mozilla.org/show_bug.cgi?id=327181
https://bugzilla.mozilla.org/show_bug.cgi?id=240261
http://xforce.iss.net/xforce/xfdb/43524
http://www.vupen.com/english/advisories/2009/0977
http://www.vupen.com/english/advisories/2008/1993/references
http://www.ubuntu.com/usn/usn-629-1
http://www.ubuntu.com/usn/usn-619-1
http://www.securitytracker.com/id?1020419
http://www.securityfocus.com/bid/30038
http://www.securityfocus.com/archive/1/archive/1/494080/100/0/threaded
http://www.securityfocus.com/archive/1/archive/1/483960/100/100/threaded
http://www.securityfocus.com/archive/1/archive/1/483937/100/100/threaded
http://www.securityfocus.com/archive/1/archive/1/483929/100/100/threaded
http://www.redhat.com/support/errata/RHSA-2008-0569.html
http://www.redhat.com/support/errata/RHSA-2008-0549.html
http://www.redhat.com/support/errata/RHSA-2008-0547.html
http://www.mozilla.org/security/announce/2008/mfsa2008-31.html
http://www.mozilla.org/projects/security/known-vulnerabilities.html#firefox2.0.0.15
http://www.mandriva.com/security/advisories?name=MDVSA-2008:155
http://www.mandriva.com/security/advisories?name=MDVSA-2008:136
http://www.debian.org/security/2009/dsa-1697
http://www.debian.org/security/2008/dsa-1621
http://www.debian.org/security/2008/dsa-1615
http://www.debian.org/security/2008/dsa-1607
http://wiki.rpath.com/Advisories:rPSA-2008-0216
http://sunsolve.sun.com/search/document.do?assetkey=1-26-256408-1
http://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.410484
http://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.384911
http://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.383152
http://securitytracker.com/id?1018979
http://securityreason.com/securityalert/3498
http://security.gentoo.org/glsa/glsa-200808-03.xml
http://secunia.com/advisories/34501
http://secunia.com/advisories/33433
http://secunia.com/advisories/31403
http://secunia.com/advisories/31377
http://secunia.com/advisories/31286
http://secunia.com/advisories/31253
http://secunia.com/advisories/31220
http://secunia.com/advisories/31195
http://secunia.com/advisories/31183
http://secunia.com/advisories/31069
http://secunia.com/advisories/31023
http://secunia.com/advisories/31021
http://secunia.com/advisories/31008
http://secunia.com/advisories/31005
http://secunia.com/advisories/30949
http://secunia.com/advisories/30911
http://secunia.com/advisories/30903
http://secunia.com/advisories/30898
http://secunia.com/advisories/30878
http://rhn.redhat.com/errata/RHSA-2008-0616.html
http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:10205
http://nils.toedtmann.net/pub/subjectAltName.txt
http://lists.opensuse.org/opensuse-security-announce/2008-07/msg00004.html

Related CVE
CVE-2018-10229
A hardware vulnerability in GPU memory modules allows attackers to accelerate micro-architectural attacks through the use of the JavaScript WebGL API.
CVE-2018-7753
An issue was discovered in Bleach 2.1.x before 2.1.3. Attributes that have URI values weren't properly sanitized if the values contained character entities. Using character entities, it was possible to construct a URI value with a scheme that was not...
CVE-2017-11698
Heap-based buffer overflow in the __get_page function in lib/dbm/src/h_page.c in Mozilla Network Security Services (NSS) allows context-dependent attackers to have unspecified impact using a crafted cert8.db file.
CVE-2017-11697
The __hash_open function in hash.c:229 in Mozilla Network Security Services (NSS) allows context-dependent attackers to cause a denial of service (floating point exception and crash) via a crafted cert8.db file.
CVE-2017-11696
Heap-based buffer overflow in the __hash_open function in lib/dbm/src/hash.c in Mozilla Network Security Services (NSS) allows context-dependent attackers to have unspecified impact using a crafted cert8.db file.
CVE-2017-11695
Heap-based buffer overflow in the alloc_segs function in lib/dbm/src/hash.c in Mozilla Network Security Services (NSS) allows context-dependent attackers to have unspecified impact using a crafted cert8.db file.
CVE-2007-5341
Remote code execution in the Venkman script debugger in Mozilla Firefox before 2.0.0.8.
CVE-2017-7502
Null pointer dereference vulnerability in NSS since 3.24.0 was found when server receives empty SSLv2 messages resulting into denial of service by remote attacker.

Copyright 2018, cxsecurity.com

 

Back to Top