CVE-2009-2702: High severity red hat kdelibs vulnerability
A method to bypass SSL certificate name vs. host name verification via NUL ('\0') character embedded in X509 certificate's CommonName or subjectAltName was presented at Black Hat USA 2009:
http://www.blackhat.com/html/bh-usa-09/bh-usa-09-archives.html#Marlinspike
Similar issues affects kdelibs' kssl. Problem only exists in handling of subjectAltNames, CommonNames with embedded NUL chars are handled correctly.
According to Thiago Macieira (maintainer of KDE's and Qt's SSL code), kssl is no longer used in current KDE4 versions, Qt's SSL code is used instead (which is affected by similar problem, see bug #520435).
Problem affects kdelibs 3.5.4 shipped in Red Hat Enterprise Linux 5. Versions in Red Hat Enterprise Linux 4 (3.3.1) and Red Hat Enterprise Linux 3 (3.1.3) are not affected, as they do not support subjectAltNames at all.
Unlike Qt, kssl is not prone to creation of universal MITM certificate (\0.whatever.com), as matching of '' wild card is limited to single host name component.
Other sources
KDE KSSL in kdelibs 3.5.4, 4.2.4, and 4.3 does not properly handle a '\0' character in a domain name in the Subject Alternative Name field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2009-2702?
CVE-2009-2702 is rated as a medium severity vulnerability due to its potential to allow man-in-the-middle attacks.
How do I fix CVE-2009-2702?
To fix CVE-2009-2702, upgrade kdelibs to version 4.3 or later.
Which versions of kdelibs are affected by CVE-2009-2702?
CVE-2009-2702 affects kdelibs versions 3.5.4, 4.2.4, and 4.3.
What type of attack does CVE-2009-2702 allow?
CVE-2009-2702 allows man-in-the-middle attackers to spoof arbitrary SSL servers.
What does CVE-2009-2702 exploit in X.509 certificates?
CVE-2009-2702 exploits improper handling of a '\0' character in the Subject Alternative Name field of X.509 certificates.