CVE-2009-2408: Input Validation
In his upcoming Blackhat paper and presentation Dan Kaminsky highlights some more issues he has found relating to SSL hash collisions and related vulnerabilities.
His second issue is all about inconsistencies in the interpretation of subject x509 names in certificates. Specifically "issue 2, attack 2c" regarding NULL terminators in a Common Name field. An attacker could create a malicious certificate containing a NULL, which, if they were able to get it signed, could confuse a client into accepting it by mistake.
According to the paper this is said to affect Firefox.
Other sources
Mozilla Network Security Services (NSS) before 3.12.3, Firefox before 3.0.13, Thunderbird before 2.0.0.23, and SeaMonkey before 1.1.18 do not properly handle a '\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority. NOTE: this was originally reported for Firefox before 3.5.
— Red Hat
Affected Software
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2009-2408?
CVE-2009-2408 is considered a high severity vulnerability due to its potential for man-in-the-middle attacks.
How do I fix CVE-2009-2408?
To mitigate CVE-2009-2408, update affected software like Mozilla Firefox, Thunderbird, and SeaMonkey to the most recent versions available.
What attack vector does CVE-2009-2408 utilize?
CVE-2009-2408 allows attackers to exploit improper handling of '\0' characters in domain names of X.509 certificates.
Which versions of software are affected by CVE-2009-2408?
CVE-2009-2408 affects Mozilla Network Security Services before 3.12.3, Firefox before 3.0.13, Thunderbird before 2.0.0.23, and SeaMonkey before 1.1.18.
What impact does CVE-2009-2408 have on security?
The exploit of CVE-2009-2408 can lead to successful man-in-the-middle attacks, compromising the confidentiality and integrity of user communications.