CVE-2009-3552
First published: Wed Oct 14 2009(Updated: )
In RHEV-M VDC 2.2.0, it was found that the SSL certificate was not verified when using the client-side Red Hat Enterprise Virtualization Manager interface (a Windows Presentation Foundation (WPF) XAML browser application) to connect to the Red Hat Enterprise Virtualization Manager. An attacker on the local network could use this flaw to conduct a man-in-the-middle attack, tricking the user into thinking they are viewing the Red Hat Enterprise Virtualization Manager when the content is actually attacker-controlled, or modifying actions a user requested Red Hat Enterprise Virtualization Manager to perform.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Red Hat Enterprise Virtualization Manager | =2.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.cve.org/CVERecord?id=CVE-2009-3552 https://nvd.nist.gov/vuln/detail/CVE-2009-3552
- https://bugzilla.redhat.com/show_bug.cgi?id=528890
- https://access.redhat.com/security/cve/cve-2009-3552
- https://rhn.redhat.com/errata/RHSA-2010-0613.html
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2009-3552
- https://www.securityfocus.com/bid/42639
Frequently Asked Questions
What is the severity of CVE-2009-3552?
CVE-2009-3552 has a medium severity rating due to the potential for man-in-the-middle attacks.
How do I fix CVE-2009-3552?
To fix CVE-2009-3552, ensure that SSL certificates are properly verified in the client-side application settings.
What software is affected by CVE-2009-3552?
CVE-2009-3552 affects Red Hat Enterprise Virtualization Manager version 2.2.
Can CVE-2009-3552 be exploited remotely?
Yes, CVE-2009-3552 can be exploited remotely by an attacker to intercept communications.
What impact does CVE-2009-3552 have on data security?
CVE-2009-3552 compromises data security by allowing potential unauthorized interception of sensitive data.
- collector/redhat-cve
- collector/redhat-bugzilla
- alias/CVE-2009-3552
- agent/type
- agent/softwarecombine
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/last-modified-date
- agent/severity
- agent/weakness
- agent/author
- agent/description
- agent/event
- agent/source
- agent/tags
- collector/nvd-historical
- agent/software-canonical-lookup-request
- collector/nvd-index
- vendor/redhat
- canonical/red hat enterprise virtualization manager
- version/red hat enterprise virtualization manager/2.2