CVE Vulnerabilities

CVE-2009-3455

Published: Sep 29, 2009 | Modified: Sep 30, 2009
CVSS 3.x
N/A
Source:
NVD
CVSS 2.x
7.5 HIGH
AV:N/AC:L/Au:N/C:P/I:P/A:P
RedHat/V2
RedHat/V3
Ubuntu

Apple Safari, possibly before 4.0.3, on Mac OS X does not properly handle a ‘0’ character in a domain name in the subject’s Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.

Affected Software

Name Vendor Start Version End Version
Safari Apple 0.8 0.8
Safari Apple 0.9 0.9
Safari Apple 1.0 1.0
Safari Apple 1.0.0 1.0.0
Safari Apple 1.0b1 1.0b1
Safari Apple 1.1 1.1
Safari Apple 1.2 1.2
Safari Apple 1.2.0 1.2.0
Safari Apple 1.2.1 1.2.1
Safari Apple 1.2.2 1.2.2
Safari Apple 1.2.3 1.2.3
Safari Apple 1.2.4 1.2.4
Safari Apple 1.2.5 1.2.5
Safari Apple 1.3 1.3
Safari Apple 1.3.1 1.3.1
Safari Apple 1.3.2 1.3.2
Safari Apple 2.0 2.0
Safari Apple 2.0.0 2.0.0
Safari Apple 2.0.1 2.0.1
Safari Apple 2.0.2 2.0.2
Safari Apple 2.0.3 2.0.3
Safari Apple 2.0.4 2.0.4
Safari Apple 3.0 3.0
Safari Apple 3.0 3.0
Safari Apple 3.0.0 3.0.0
Safari Apple 3.0.1 3.0.1
Safari Apple 3.0.3 3.0.3
Safari Apple 3.0.3 3.0.3
Safari Apple 3.0.4 3.0.4
Safari Apple 3.0.4 3.0.4
Safari Apple 3.1 3.1
Safari Apple 3.1 3.1
Safari Apple 3.1.0 3.1.0
Safari Apple 3.1.1 3.1.1
Safari Apple 3.1.1 3.1.1
Safari Apple 3.1.2 3.1.2
Safari Apple 3.1.2 3.1.2
Safari Apple 3.2 3.2
Safari Apple 3.2.1 3.2.1
Safari Apple 3.2.1 3.2.1
Safari Apple 3.2.3 3.2.3
Safari Apple 3.2.3 3.2.3
Safari Apple 4.0 4.0
Safari Apple 4.0.0b 4.0.0b
Safari Apple 4.0.1 4.0.1
Safari Apple 4.0.2 4.0.2
Safari Apple * 4.0.2
Safari Apple 4.0_beta 4.0_beta

References