CVE-2009-3765

{"id": "CVE-2009-3765", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2009-10-23T19:30:00.203", "references": [{"url": "http://dev.mutt.org/trac/changeset/6016:dc09812e63a3/mutt_ssl.c", "source": "cve@mitre.org"}, {"url": "http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.html", "source": "cve@mitre.org"}, {"url": "http://marc.info/?l=oss-security&m=125198917018936&w=2", "source": "cve@mitre.org"}, {"url": "http://marc.info/?l=oss-security&m=125369675820512&w=2", "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-310"}]}], "descriptions": [{"lang": "en", "value": "mutt_ssl.c in mutt 1.5.19 and 1.5.20, when OpenSSL is used, does not properly handle a '\\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408."}, {"lang": "es", "value": "mutt_ssl.c en mutt 1.5.19 y 1.5.20, cuando usa OenSSL, no maneja de forma adecuada el caracter '\\0' en un nombre de dominio, dentro del campo sujeto del Common Name (CN) en los certificados X.509, lo que permite a atacantes man-in-the-middle, esp\u00edar servidores SSL de su elecci\u00f3n a trav\u00e9s de certificados manipulados concedidos por Autoridades Certificadoras, esta relacionado con CVE-2009-2408."}], "lastModified": "2009-10-29T04:00:00.000", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mutt:mutt:1.5.19:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "89C33B31-B9BC-4E43-8221-219380B4B682"}, {"criteria": "cpe:2.3:a:mutt:mutt:1.5.20:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "591AA471-643C-49FB-8922-F91774946177"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "DDA1CA86-1405-4C25-9BC2-5A5E6A76B911"}], "operator": "OR"}], "operator": "AND"}], "vendorComments": [{"comment": "Not vulnerable. This issue did not affect the versions of mutt as shipped with Red Hat Enterprise Linux 3, 4, or 5.\n", "lastModified": "2009-10-26T00:00:00", "organization": "Red Hat"}], "sourceIdentifier": "cve@mitre.org"}