Vulnerability CVE-2008-2809


Published: 2008-07-08   Modified: 2012-02-12

Description:
Mozilla 1.9 M8 and earlier, Mozilla Firefox 2 before 2.0.0.15, SeaMonkey 1.1.5 and other versions before 1.1.10, Netscape 9.0, and other Mozilla-based web browsers, when a user accepts an SSL server certificate on the basis of the CN domain name in the DN field, regard the certificate as also accepted for all domain names in subjectAltName:dNSName fields, which makes it easier for remote attackers to trick a user into accepting an invalid certificate for a spoofed web site.

See advisories in our WLB2 database:
Topic
Author
Date
Med.
Certificate spoofing issue with Mozilla, Konqueror, Safari 2
Nils Toedtmann
28.12.2007

Type:

CWE-20

(Improper Input Validation)

Vendor: Netscape
Product: Navigator 
Version: 9.0;
Vendor: Mozilla
Product: Firefox 
Version:
2.0.0.9
2.0.0.8
2.0.0.7
2.0.0.6
2.0.0.5
2.0.0.4
2.0.0.3
2.0.0.2
2.0.0.14
2.0.0.13
2.0.0.12
2.0.0.11
2.0.0.10
2.0.0.1
Product: Geckb 
Version: 1.9;
Product: Seamonkey 
Version: 1.1.5; 1.0.9;

CVSS2 => (AV:N/AC:H/Au:N/C:N/I:P/A:P)

CVSS Base Score
Impact Subscore
Exploitability Subscore
4/10
4.9/10
4.9/10
Exploit range
Attack complexity
Authentication
Remote
High
No required
Confidentiality impact
Integrity impact
Availability impact
None
Partial
Partial

 References:
https://www.redhat.com/archives/fedora-package-announce/2008-July/msg00295.html
https://www.redhat.com/archives/fedora-package-announce/2008-July/msg00288.html
https://www.redhat.com/archives/fedora-package-announce/2008-July/msg00207.html
https://www.redhat.com/archives/fedora-package-announce/2008-August/msg00144.html
https://www.redhat.com/archives/fedora-package-announce/2008-August/msg00125.html
https://issues.rpath.com/browse/RPL-2646
https://bugzilla.mozilla.org/show_bug.cgi?id=402347
https://bugzilla.mozilla.org/show_bug.cgi?id=327181
https://bugzilla.mozilla.org/show_bug.cgi?id=240261
http://xforce.iss.net/xforce/xfdb/43524
http://www.vupen.com/english/advisories/2009/0977
http://www.vupen.com/english/advisories/2008/1993/references
http://www.ubuntu.com/usn/usn-629-1
http://www.ubuntu.com/usn/usn-619-1
http://www.securitytracker.com/id?1020419
http://www.securityfocus.com/bid/30038
http://www.securityfocus.com/archive/1/archive/1/494080/100/0/threaded
http://www.securityfocus.com/archive/1/archive/1/483960/100/100/threaded
http://www.securityfocus.com/archive/1/archive/1/483937/100/100/threaded
http://www.securityfocus.com/archive/1/archive/1/483929/100/100/threaded
http://www.redhat.com/support/errata/RHSA-2008-0569.html
http://www.redhat.com/support/errata/RHSA-2008-0549.html
http://www.redhat.com/support/errata/RHSA-2008-0547.html
http://www.mozilla.org/security/announce/2008/mfsa2008-31.html
http://www.mozilla.org/projects/security/known-vulnerabilities.html#firefox2.0.0.15
http://www.mandriva.com/security/advisories?name=MDVSA-2008:155
http://www.mandriva.com/security/advisories?name=MDVSA-2008:136
http://www.debian.org/security/2009/dsa-1697
http://www.debian.org/security/2008/dsa-1621
http://www.debian.org/security/2008/dsa-1615
http://www.debian.org/security/2008/dsa-1607
http://wiki.rpath.com/Advisories:rPSA-2008-0216
http://sunsolve.sun.com/search/document.do?assetkey=1-26-256408-1
http://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.410484
http://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.384911
http://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.383152
http://securitytracker.com/id?1018979
http://securityreason.com/securityalert/3498
http://security.gentoo.org/glsa/glsa-200808-03.xml
http://secunia.com/advisories/34501
http://secunia.com/advisories/33433
http://secunia.com/advisories/31403
http://secunia.com/advisories/31377
http://secunia.com/advisories/31286
http://secunia.com/advisories/31253
http://secunia.com/advisories/31220
http://secunia.com/advisories/31195
http://secunia.com/advisories/31183
http://secunia.com/advisories/31069
http://secunia.com/advisories/31023
http://secunia.com/advisories/31021
http://secunia.com/advisories/31008
http://secunia.com/advisories/31005
http://secunia.com/advisories/30949
http://secunia.com/advisories/30911
http://secunia.com/advisories/30903
http://secunia.com/advisories/30898
http://secunia.com/advisories/30878
http://rhn.redhat.com/errata/RHSA-2008-0616.html
http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:10205
http://nils.toedtmann.net/pub/subjectAltName.txt
http://lists.opensuse.org/opensuse-security-announce/2008-07/msg00004.html

Related CVE
CVE-2018-12438
The Elliptic Curve Cryptography library (aka sunec or libsunec) allows a memory-cache side-channel attack on ECDSA signatures, aka the Return Of the Hidden Number Problem or ROHNP. To discover an ECDSA key, the attacker needs access to either the loc...
CVE-2018-12437
LibTomCrypt through 1.18.1 allows a memory-cache side-channel attack on ECDSA signatures, aka the Return Of the Hidden Number Problem or ROHNP. To discover an ECDSA key, the attacker needs access to either the local machine or a different virtual mac...
CVE-2018-12433
** DISPUTED ** cryptlib through 3.4.4 allows a memory-cache side-channel attack on DSA and ECDSA signatures, aka the Return Of the Hidden Number Problem or ROHNP. To discover a key, the attacker needs access to either the local machine or a different...
CVE-2018-5185
Plaintext of decrypted emails can leak through by user submitting an embedded form. This vulnerability affects Thunderbird ESR < 52.8 and Thunderbird < 52.8.
CVE-2018-5184
Using remote content in encrypted messages can lead to the disclosure of plaintext. This vulnerability affects Thunderbird ESR < 52.8 and Thunderbird < 52.8.
CVE-2018-5183
Mozilla developers backported selected changes in the Skia library. These changes correct memory corruption issues including invalid buffer reads and writes during graphic operations. This vulnerability affects Thunderbird ESR < 52.8, Thunderbird < 5...
CVE-2018-5182
If a text string that happens to be a filename in the operating system's native format is dragged and dropped onto the addressbar the specified local file will be opened. This is contrary to policy and is what would happen if the string were the equi...
CVE-2018-5181
If a URL using the "file:" protocol is dragged and dropped onto an open tab that is running in a different child process the tab will open a local file corresponding to the dropped URL, contrary to policy. One way to make the target tab open more rel...

Copyright 2018, cxsecurity.com

 

Back to Top