Details of VAR-200909-0290

ID

VAR-200909-0290

CVE

CVE-2009-3455

TITLE

Apple Safari In any SSL Vulnerability impersonating a server

Trust: 0.8

sources: JVNDB: JVNDB-2009-003799

DESCRIPTION

Apple Safari, possibly before 4.0.3, on Mac OS X does not properly handle a '\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408. SSL A vulnerability that impersonates a server exists. The problem is CVE-2009-2408 The problem is related to.By attackers, through a crafted certificate SSL There is a possibility of impersonating a server. Successfully exploiting this issue allows attackers to perform man-in-the-middle attacks or impersonate trusted servers, which will aid in further attacks. UPDATE (October 5, 2009): The vendor states that Safari on Mac OS X is not affected by this issue. This vulnerability is related to CVE-2009-2408

Trust: 1.98

sources: NVD: CVE-2009-3455 // JVNDB: JVNDB-2009-003799 // BID: 36477 // VULHUB: VHN-40901

AFFECTED PRODUCTS

vendor:	apple	model:	safari	scope:	eq	version:	1.2.2	Trust: 1.6
vendor:	apple	model:	safari	scope:	eq	version:	1.2.3	Trust: 1.6
vendor:	apple	model:	safari	scope:	eq	version:	1.2.0	Trust: 1.6
vendor:	apple	model:	safari	scope:	eq	version:	1.2.1	Trust: 1.6
vendor:	apple	model:	safari	scope:	eq	version:	1.3.1	Trust: 1.6
vendor:	apple	model:	safari	scope:	eq	version:	1.2.4	Trust: 1.6
vendor:	apple	model:	safari	scope:	eq	version:	1.2	Trust: 1.6
vendor:	apple	model:	safari	scope:	eq	version:	1.1	Trust: 1.6
vendor:	apple	model:	safari	scope:	eq	version:	1.2.5	Trust: 1.6
vendor:	apple	model:	safari	scope:	eq	version:	1.3.2	Trust: 1.6
vendor:	apple	model:	safari	scope:	eq	version:	4.0.1	Trust: 1.0
vendor:	apple	model:	safari	scope:	eq	version:	0.9	Trust: 1.0
vendor:	apple	model:	safari	scope:	eq	version:	3.1	Trust: 1.0
vendor:	apple	model:	safari	scope:	eq	version:	3.0.0	Trust: 1.0
vendor:	apple	model:	safari	scope:	eq	version:	4.0.2	Trust: 1.0
vendor:	apple	model:	safari	scope:	eq	version:	3.0.4	Trust: 1.0
vendor:	apple	model:	safari	scope:	eq	version:	2.0.4	Trust: 1.0
vendor:	apple	model:	safari	scope:	eq	version:	3.1.1	Trust: 1.0
vendor:	apple	model:	safari	scope:	eq	version:	1.0	Trust: 1.0
vendor:	apple	model:	safari	scope:	eq	version:	1.0.0	Trust: 1.0
vendor:	apple	model:	safari	scope:	eq	version:	3.2.3	Trust: 1.0
vendor:	apple	model:	safari	scope:	eq	version:	1.0b1	Trust: 1.0
vendor:	apple	model:	safari	scope:	eq	version:	2.0	Trust: 1.0
vendor:	apple	model:	safari	scope:	eq	version:	4.0_beta	Trust: 1.0
vendor:	apple	model:	safari	scope:	eq	version:	3.0.3	Trust: 1.0
vendor:	apple	model:	safari	scope:	eq	version:	4.0.0b	Trust: 1.0
vendor:	apple	model:	safari	scope:	eq	version:	3.0	Trust: 1.0
vendor:	apple	model:	safari	scope:	eq	version:	2.0.2	Trust: 1.0
vendor:	apple	model:	safari	scope:	eq	version:	2.0.1	Trust: 1.0
vendor:	apple	model:	safari	scope:	eq	version:	3.0.1	Trust: 1.0
vendor:	apple	model:	safari	scope:	eq	version:	1.3	Trust: 1.0
vendor:	apple	model:	safari	scope:	eq	version:	2.0.3	Trust: 1.0
vendor:	apple	model:	safari	scope:	lte	version:	4.0.2	Trust: 1.0
vendor:	apple	model:	safari	scope:	eq	version:	4.0	Trust: 1.0
vendor:	apple	model:	safari	scope:	eq	version:	2.0.0	Trust: 1.0
vendor:	apple	model:	safari	scope:	eq	version:	3.1.2	Trust: 1.0
vendor:	apple	model:	safari	scope:	eq	version:	0.8	Trust: 1.0
vendor:	apple	model:	safari	scope:	eq	version:	3.2.1	Trust: 1.0
vendor:	apple	model:	safari	scope:	eq	version:	3.1.0	Trust: 1.0
vendor:	apple	model:	safari	scope:	eq	version:	3.2	Trust: 1.0
vendor:	apple	model:	safari	scope:	lt	version:	mac os x edition 4.0.3	Trust: 0.8
vendor:	apple	model:	safari for windows	scope:	eq	version:	3.2.1	Trust: 0.3
vendor:	apple	model:	safari for windows	scope:	eq	version:	4.0.3	Trust: 0.3
vendor:	apple	model:	safari for windows	scope:	eq	version:	4.0.2	Trust: 0.3
vendor:	apple	model:	safari for windows	scope:	eq	version:	3.2.3	Trust: 0.3
vendor:	apple	model:	safari for windows	scope:	eq	version:	3.2.2	Trust: 0.3
vendor:	apple	model:	safari for windows	scope:	eq	version:	3.1.2	Trust: 0.3
vendor:	apple	model:	safari for windows	scope:	eq	version:	3.1.1	Trust: 0.3
vendor:	apple	model:	safari beta for windows	scope:	eq	version:	3.0.4	Trust: 0.3
vendor:	apple	model:	safari beta for windows	scope:	eq	version:	3.0.3	Trust: 0.3
vendor:	apple	model:	safari beta for windows	scope:	eq	version:	3.0.2	Trust: 0.3
vendor:	apple	model:	safari beta for windows	scope:	eq	version:	3.0.1	Trust: 0.3
vendor:	apple	model:	safari for windows	scope:	eq	version:	4	Trust: 0.3
vendor:	apple	model:	safari for windows	scope:	eq	version:	3.1	Trust: 0.3
vendor:	apple	model:	safari beta for windows	scope:	eq	version:	3	Trust: 0.3

sources: BID: 36477 // JVNDB: JVNDB-2009-003799 // CNNVD: CNNVD-200910-054 // NVD: CVE-2009-3455

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2009-3455
value:	HIGH
Trust: 1.0
NVD:	CVE-2009-3455
value:	HIGH
Trust: 0.8
CNNVD:	CNNVD-200910-054
value:	HIGH
Trust: 0.6
VULHUB:	VHN-40901
value:	HIGH
Trust: 0.1

nvd@nist.gov:	CVE-2009-3455
severity:	HIGH
baseScore:	7.5
vectorString:	AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	10.0
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
VULHUB:	VHN-40901
severity:	HIGH
baseScore:	7.5
vectorString:	AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	10.0
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

sources: VULHUB: VHN-40901 // JVNDB: JVNDB-2009-003799 // CNNVD: CNNVD-200910-054 // NVD: CVE-2009-3455

PROBLEMTYPE DATA

problemtype:

CWE-310

Trust: 1.9

sources: VULHUB: VHN-40901 // JVNDB: JVNDB-2009-003799 // NVD: CVE-2009-3455

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-200910-054

TYPE

encryption problem

Trust: 0.6

sources: CNNVD: CNNVD-200910-054

CONFIGURATIONS

sources: JVNDB: JVNDB-2009-003799

PATCH

title:

Top Page

url:

http://www.apple.com/safari/

Trust: 0.8

sources: JVNDB: JVNDB-2009-003799

EXTERNAL IDS

db:	NVD	id:	CVE-2009-3455	Trust: 2.8
db:	BID	id:	36477	Trust: 2.0
db:	JVNDB	id:	JVNDB-2009-003799	Trust: 0.8
db:	CNNVD	id:	CNNVD-200910-054	Trust: 0.7
db:	VULHUB	id:	VHN-40901	Trust: 0.1

sources: VULHUB: VHN-40901 // BID: 36477 // JVNDB: JVNDB-2009-003799 // CNNVD: CNNVD-200910-054 // NVD: CVE-2009-3455

REFERENCES

url:	http://www.securityfocus.com/bid/36477	Trust: 1.7
url:	http://www.networkworld.com/news/2009/091709-microsoft-ie-security-hole.html	Trust: 1.7
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2009-3455	Trust: 0.8
url:	http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2009-3455	Trust: 0.8
url:	http://www.apple.com/safari/	Trust: 0.3
url:	https://www.blackhat.com/html/bh-usa-09/bh-usa-09-archives.html#marlinspike	Trust: 0.3
url:	http://www.thoughtcrime.org/papers/null-prefix-attacks.pdf	Trust: 0.3
url:	http://www.h-online.com/security/ssl-flaw-revealed-at-black-hat--/news/113880	Trust: 0.3
url:	http://www.wired.com/threatlevel/2009/07/kaminsky/	Trust: 0.3

sources: VULHUB: VHN-40901 // BID: 36477 // JVNDB: JVNDB-2009-003799 // CNNVD: CNNVD-200910-054 // NVD: CVE-2009-3455

CREDITS

Dan Kaminsky and Moxie Marlinspike

Trust: 0.9

sources: BID: 36477 // CNNVD: CNNVD-200910-054

SOURCES

db:	VULHUB	id:	VHN-40901
db:	BID	id:	36477
db:	JVNDB	id:	JVNDB-2009-003799
db:	CNNVD	id:	CNNVD-200910-054
db:	NVD	id:	CVE-2009-3455

LAST UPDATE DATE

2025-04-10T23:06:56.525000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-40901	date:	2009-09-30T00:00:00
db:	BID	id:	36477	date:	2015-04-13T21:06:00
db:	JVNDB	id:	JVNDB-2009-003799	date:	2012-06-26T00:00:00
db:	CNNVD	id:	CNNVD-200910-054	date:	2009-09-30T00:00:00
db:	NVD	id:	CVE-2009-3455	date:	2025-04-09T00:30:58.490

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-40901	date:	2009-09-29T00:00:00
db:	BID	id:	36477	date:	2009-07-30T00:00:00
db:	JVNDB	id:	JVNDB-2009-003799	date:	2012-06-26T00:00:00
db:	CNNVD	id:	CNNVD-200910-054	date:	2009-09-29T00:00:00
db:	NVD	id:	CVE-2009-3455	date:	2009-09-29T18:00:00.360