LWN.net Logo

curl: null prefix vulnerability

Package(s):curl wget CVE #(s):CVE-2009-2417 CVE-2009-2408
Created:August 14, 2009 Updated:June 24, 2011
Description: From the Red Hat alert: Scott Cantor reported that cURL is affected by the previously published "null prefix attack", caused by incorrect handling of NULL characters in X.509 certificates. If an attacker is able to get a carefully-crafted certificate signed by a trusted Certificate Authority, the attacker could use the certificate during a man-in-the-middle attack and potentially confuse cURL into accepting it by mistake.

The wget tool also suffers from the same vulnerability.

Alerts:
Ubuntu USN-1158-1 2011-06-24
Mandriva MDVSA-2009:330 2009-12-10
Mandriva MDVSA-2009:206-1 2009-12-04
Mandriva MDVSA-2009:203-1 2009-12-04
Mandriva MDVSA-2009:217-1 2009-08-23
Gentoo 200909-20 2009-09-25
Mandriva MDVSA-2009:217-2 2009-10-08
Mandriva MDVSA-2009:197-2 2009-09-11
CentOS CESA-2009:1432 2009-09-10
Red Hat RHSA-2009:1432-01 2009-09-09
SuSE SUSE-SR:2009:014 2009-09-01
Debian DSA-1874-1 2009-08-26
rPath rPSA-2009-0124-1 2009-08-24
Mandriva MDVSA-2009:217 2009-08-23
Mandriva MDVSA-2009:216 2009-08-23
Debian DSA-1869-1 2009-08-19
Mandriva MDVSA-2009:206 2009-08-18
Slackware SSA:2009-226-01 2009-08-17
Mandriva MDVSA-2009:203 2009-08-15
Ubuntu USN-818-1 2009-08-17
CentOS CESA-2009:1209 2009-08-14
Red Hat RHSA-2009:1209-01 2009-08-13
SuSE SUSE-SA:2009:048 2009-10-20
SuSE SUSE-SR:2009:016 2009-10-13
Gentoo 201301-01 2013-01-07

(Log in to post comments)

Copyright © 2013, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds