Vulnerabilidad en libssluse.c en cURL y libcurl en OpenSSL (CVE-2009-2417)
Gravedad CVSS v2.0:
ALTA
Tipo:
CWE-310
Errores criptográficos
Fecha de publicación:
14/08/2009
Última modificación:
09/04/2025
Descripción
lib/ssluse.c en cURL y libcurl v7.4 hasta v7.19.5, cuando se usa OpenSSL, no maneja de forma aecuada el caracter '\0' en un nombre de dominio en el campo sujeto del Common Name (CN) de un certificado X.509, lo que permite a atacantes de hombre en el medio hacer un spoofing de servidores SSL a través de la un certificado de una autoridad de Certificación legítima, manipulado, relativo a CVE_2009-2408.
Impacto
Puntuación base 2.0
7.50
Gravedad 2.0
ALTA
Productos y versiones vulnerables
| CPE | Desde | Hasta |
|---|---|---|
| cpe:2.3:a:curl:libcurl:7.4:*:*:*:*:*:*:* | ||
| cpe:2.3:a:curl:libcurl:7.4.1:*:*:*:*:*:*:* | ||
| cpe:2.3:a:curl:libcurl:7.4.2:*:*:*:*:*:*:* | ||
| cpe:2.3:a:curl:libcurl:7.5:*:*:*:*:*:*:* | ||
| cpe:2.3:a:curl:libcurl:7.5.1:*:*:*:*:*:*:* | ||
| cpe:2.3:a:curl:libcurl:7.5.2:*:*:*:*:*:*:* | ||
| cpe:2.3:a:curl:libcurl:7.6:*:*:*:*:*:*:* | ||
| cpe:2.3:a:curl:libcurl:7.6.1:*:*:*:*:*:*:* | ||
| cpe:2.3:a:curl:libcurl:7.7:*:*:*:*:*:*:* | ||
| cpe:2.3:a:curl:libcurl:7.7.1:*:*:*:*:*:*:* | ||
| cpe:2.3:a:curl:libcurl:7.7.2:*:*:*:*:*:*:* | ||
| cpe:2.3:a:curl:libcurl:7.7.3:*:*:*:*:*:*:* | ||
| cpe:2.3:a:curl:libcurl:7.8:*:*:*:*:*:*:* | ||
| cpe:2.3:a:curl:libcurl:7.8.1:*:*:*:*:*:*:* | ||
| cpe:2.3:a:curl:libcurl:7.9:*:*:*:*:*:*:* |
Para consultar la lista completa de nombres de CPE con productos y versiones, ver esta página
Referencias a soluciones, herramientas e información
- http://curl.haxx.se/CVE-2009-2417/curl-7.10.6-CVE-2009-2417.patch
- http://curl.haxx.se/CVE-2009-2417/curl-7.11.0-CVE-2009-2417.patch
- http://curl.haxx.se/CVE-2009-2417/curl-7.12.1-CVE-2009-2417.patch
- http://curl.haxx.se/CVE-2009-2417/curl-7.15.1-CVE-2009-2417.patch
- http://curl.haxx.se/CVE-2009-2417/curl-7.15.5-CVE-2009-2417.patch
- http://curl.haxx.se/CVE-2009-2417/curl-7.16.4-CVE-2009-2417.patch
- http://curl.haxx.se/CVE-2009-2417/curl-7.18.1-CVE-2009-2417.patch
- http://curl.haxx.se/CVE-2009-2417/curl-7.19.0-CVE-2009-2417.patch
- http://curl.haxx.se/CVE-2009-2417/curl-7.19.5-CVE-2009-2417.patch
- http://curl.haxx.se/docs/adv_20090812.txt
- http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html
- http://secunia.com/advisories/36238
- http://secunia.com/advisories/36475
- http://secunia.com/advisories/37471
- http://secunia.com/advisories/45047
- http://shibboleth.internet2.edu/secadv/secadv_20090817.txt
- http://support.apple.com/kb/HT4077
- http://wiki.rpath.com/Advisories:rPSA-2009-0124
- http://www.securityfocus.com/archive/1/506055/100/0/threaded
- http://www.securityfocus.com/archive/1/507985/100/0/threaded
- http://www.securityfocus.com/bid/36032
- http://www.ubuntu.com/usn/USN-1158-1
- http://www.vmware.com/security/advisories/VMSA-2009-0016.html
- http://www.vupen.com/english/advisories/2009/2263
- http://www.vupen.com/english/advisories/2009/3316
- https://exchange.xforce.ibmcloud.com/vulnerabilities/52405
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10114
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8542
- http://curl.haxx.se/CVE-2009-2417/curl-7.10.6-CVE-2009-2417.patch
- http://curl.haxx.se/CVE-2009-2417/curl-7.11.0-CVE-2009-2417.patch
- http://curl.haxx.se/CVE-2009-2417/curl-7.12.1-CVE-2009-2417.patch
- http://curl.haxx.se/CVE-2009-2417/curl-7.15.1-CVE-2009-2417.patch
- http://curl.haxx.se/CVE-2009-2417/curl-7.15.5-CVE-2009-2417.patch
- http://curl.haxx.se/CVE-2009-2417/curl-7.16.4-CVE-2009-2417.patch
- http://curl.haxx.se/CVE-2009-2417/curl-7.18.1-CVE-2009-2417.patch
- http://curl.haxx.se/CVE-2009-2417/curl-7.19.0-CVE-2009-2417.patch
- http://curl.haxx.se/CVE-2009-2417/curl-7.19.5-CVE-2009-2417.patch
- http://curl.haxx.se/docs/adv_20090812.txt
- http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html
- http://secunia.com/advisories/36238
- http://secunia.com/advisories/36475
- http://secunia.com/advisories/37471
- http://secunia.com/advisories/45047
- http://shibboleth.internet2.edu/secadv/secadv_20090817.txt
- http://support.apple.com/kb/HT4077
- http://wiki.rpath.com/Advisories:rPSA-2009-0124
- http://www.securityfocus.com/archive/1/506055/100/0/threaded
- http://www.securityfocus.com/archive/1/507985/100/0/threaded
- http://www.securityfocus.com/bid/36032
- http://www.ubuntu.com/usn/USN-1158-1
- http://www.vmware.com/security/advisories/VMSA-2009-0016.html
- http://www.vupen.com/english/advisories/2009/2263
- http://www.vupen.com/english/advisories/2009/3316
- https://exchange.xforce.ibmcloud.com/vulnerabilities/52405
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10114
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8542