REDHAT-BUG-520454
First published: Mon Aug 31 2009(Updated: )
A method to bypass SSL certificate name vs. host name verification via NUL ('\0') character embedded in X509 certificate's CommonName or subjectAltName was presented at Black Hat USA 2009: <a href="http://www.blackhat.com/html/bh-usa-09/bh-usa-09-archives.html#Marlinspike">http://www.blackhat.com/html/bh-usa-09/bh-usa-09-archives.html#Marlinspike</a> Similar problem affected wget (from a testing and very quick look at the code, subjectAltNames are not supported, hence only CommonName is a vector). Upstream bug report: <a href="http://savannah.gnu.org/bugs/?27183">http://savannah.gnu.org/bugs/?27183</a> (currently not public) Contents of upstream bug report, leaked via wget-notify list: <a href="http://addictivecode.org/pipermail/wget-notify/2009-August/001808.html">http://addictivecode.org/pipermail/wget-notify/2009-August/001808.html</a> Upstream fixes: <a href="http://hg.addictivecode.org/wget/mainline/rev/2d8c76a23e7d">http://hg.addictivecode.org/wget/mainline/rev/2d8c76a23e7d</a> <a href="http://hg.addictivecode.org/wget/mainline/rev/f2d2ca32fd1b">http://hg.addictivecode.org/wget/mainline/rev/f2d2ca32fd1b</a> <a href="http://hg.addictivecode.org/wget/mainline/rev/1eab157d3be7">http://hg.addictivecode.org/wget/mainline/rev/1eab157d3be7</a>
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Wget |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.blackhat.com/html/bh-usa-09/bh-usa-09-archives.html#Marlinspike
- http://savannah.gnu.org/bugs/?27183
- http://addictivecode.org/pipermail/wget-notify/2009-August/001808.html
- http://hg.addictivecode.org/wget/mainline/rev/2d8c76a23e7d
- http://hg.addictivecode.org/wget/mainline/rev/f2d2ca32fd1b
- http://hg.addictivecode.org/wget/mainline/rev/1eab157d3be7
- http://permalink.gmane.org/gmane.comp.web.wget.general/8972
- https://rhn.redhat.com/errata/RHSA-2009-1549.html
- http://admin.fedoraproject.org/updates/wget-1.12-1.fc11
- http://admin.fedoraproject.org/updates/wget-1.12-1.fc12
- http://admin.fedoraproject.org/updates/wget-1.12-1.fc10
- http://admin.fedoraproject.org/updates/wget-1.12-2.fc12
- https://bugzilla.redhat.com/show_bug.cgi?id=520454
Frequently Asked Questions
What is the severity of REDHAT-BUG-520454?
The severity of REDHAT-BUG-520454 is considered high due to the security implications of SSL certificate validation bypass.
How do I fix REDHAT-BUG-520454?
To fix REDHAT-BUG-520454, ensure you are using the latest version of GNU Wget, which may include patches for this vulnerability.
What impact does REDHAT-BUG-520454 have on SSL connections?
REDHAT-BUG-520454 allows attackers to bypass SSL certificate hostname verification, potentially leading to man-in-the-middle attacks.
Is my version of GNU Wget affected by REDHAT-BUG-520454?
If you are using an older version of GNU Wget prior to the patch for REDHAT-BUG-520454, you are likely affected by this vulnerability.
What are the implications of exploiting REDHAT-BUG-520454?
Exploiting REDHAT-BUG-520454 could allow an attacker to impersonate a legitimate server, compromising the confidentiality and integrity of the data transmitted.
- agent/type
- agent/first-publish-date
- agent/last-modified-date
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2009-3490
- agent/severity
- agent/references
- agent/description
- agent/event
- agent/trending
- agent/source
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/gnu
- canonical/wget