CVE-2009-3490: Medium severity wget vulnerability
A method to bypass SSL certificate name vs. host name verification via NUL ('\0') character embedded in X509 certificate's CommonName or subjectAltName was presented at Black Hat USA 2009:
http://www.blackhat.com/html/bh-usa-09/bh-usa-09-archives.html#Marlinspike
Similar problem affected wget (from a testing and very quick look at the code, subjectAltNames are not supported, hence only CommonName is a vector).
Upstream bug report: http://savannah.gnu.org/bugs/?27183 (currently not public)
Contents of upstream bug report, leaked via wget-notify list: http://addictivecode.org/pipermail/wget-notify/2009-August/001808.html
Upstream fixes: http://hg.addictivecode.org/wget/mainline/rev/2d8c76a23e7d http://hg.addictivecode.org/wget/mainline/rev/f2d2ca32fd1b http://hg.addictivecode.org/wget/mainline/rev/1eab157d3be7
Other sources
GNU Wget before 1.12 does not properly handle a '\0' character in a domain name in the Common Name field of an X.509 certificate, which allows man-in-the-middle remote attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2009-3490?
CVE-2009-3490 has been classified as a critical severity vulnerability due to its potential to bypass SSL certificate verification.
How do I fix CVE-2009-3490?
To mitigate CVE-2009-3490, upgrade to a version of GNU Wget that is greater than 1.11.4, which addresses this vulnerability.
Who is affected by CVE-2009-3490?
CVE-2009-3490 affects multiple versions of GNU Wget, notably versions ranging from 1.5.3 up to 1.11.4.
What can attackers achieve by exploiting CVE-2009-3490?
Attackers can exploit CVE-2009-3490 to perform man-in-the-middle attacks by misleading users about the authenticity of SSL certificates.
When was CVE-2009-3490 disclosed?
CVE-2009-3490 was disclosed during the Black Hat USA conference in 2009.