CVE-2009-3477: Medium severity blackberry device software vulnerability
The Blackberry Browser in RIM BlackBerry Device Software 4.5.0 before 4.5.0.173, 4.6.0 before 4.6.0.303, 4.6.1 before 4.6.1.309, 4.7.0 before 4.7.0.179, and 4.7.1 before 4.7.1.57 does not properly handle "hidden" characters including a '\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows remote man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2009-3477?
CVE-2009-3477 has a severity rating that indicates potential security risks specifically related to the handling of hidden characters in domain names.
How do I fix CVE-2009-3477?
To fix CVE-2009-3477, update your RIM BlackBerry Device Software to version 4.5.0.173, 4.6.0.303, 4.6.1.309, 4.7.0.179, or 4.7.1.57, or a later version.
What software versions are affected by CVE-2009-3477?
CVE-2009-3477 affects RIM BlackBerry Device Software versions 4.5.0 up to 4.5.0.173, 4.6.0 up to 4.6.0.303, 4.6.1 up to 4.6.1.309, 4.7.0 up to 4.7.0.179, and 4.7.1 up to 4.7.1.57.
What kind of vulnerabilities does CVE-2009-3477 relate to?
CVE-2009-3477 is related to improper handling of hidden characters in domain names, which can lead to potential security exploits.
Is there a workaround for CVE-2009-3477?
Currently, the best recommendation for CVE-2009-3477 is to apply the available updates rather than relying on workarounds.