CVE-2009-2417

Published: Aug 14, 2009Modified: Apr 23, 2026

7.5

Vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability: 10.0 / Impact: 6.4

Source: NVD

Description

lib/ssluse.c in cURL and libcurl 7.4 through 7.19.5, when OpenSSL is used, does not properly handle a '\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.

Affected (74)

Products: Curl: Libcurl · Libcurl: Libcurl

Curl

1 product

Libcurl

1 product

Libcurl

Configuration A

74 vulnerable

Vulnerable Software	Affected Versions
Curl Libcurl	Version 7.10.1
Curl Libcurl	Version 7.10.2
Curl Libcurl	Version 7.10.3
Curl Libcurl	Version 7.10.4
Curl Libcurl	Version 7.10.5
Curl Libcurl	Version 7.10.6
Curl Libcurl	Version 7.10.7
Curl Libcurl	Version 7.10.8
Curl Libcurl	Version 7.10
Curl Libcurl	Version 7.11.0
Curl Libcurl	Version 7.11.1
Curl Libcurl	Version 7.11.2
Curl Libcurl	Version 7.12.0
Curl Libcurl	Version 7.12.1
Curl Libcurl	Version 7.12.2
Curl Libcurl	Version 7.12.3
Curl Libcurl	Version 7.12
Curl Libcurl	Version 7.13.1
Curl Libcurl	Version 7.13.2
Curl Libcurl	Version 7.13
Curl Libcurl	Version 7.14.1
Curl Libcurl	Version 7.14
Curl Libcurl	Version 7.15.1
Curl Libcurl	Version 7.15.2
Curl Libcurl	Version 7.15.3
Curl Libcurl	Version 7.15
Curl Libcurl	Version 7.16.3
Curl Libcurl	Version 7.17.0
Curl Libcurl	Version 7.17.1
Curl Libcurl	Version 7.18.0
Curl Libcurl	Version 7.18.1
Curl Libcurl	Version 7.18.2
Curl Libcurl	Version 7.19.0
Curl Libcurl	Version 7.19.1
Curl Libcurl	Version 7.19.2
Curl Libcurl	Version 7.19.3
Curl Libcurl	Version 7.19.4
Curl Libcurl	Version 7.19.5
Curl Libcurl	Version 7.4.1
Curl Libcurl	Version 7.4.2
Curl Libcurl	Version 7.4
Curl Libcurl	Version 7.5.1
Curl Libcurl	Version 7.5.2
Curl Libcurl	Version 7.5
Curl Libcurl	Version 7.6.1
Curl Libcurl	Version 7.6
Curl Libcurl	Version 7.7.1
Curl Libcurl	Version 7.7.2
Curl Libcurl	Version 7.7.3
Curl Libcurl	Version 7.7
Curl Libcurl	Version 7.8.1
Curl Libcurl	Version 7.8
Curl Libcurl	Version 7.9.1
Curl Libcurl	Version 7.9.2
Curl Libcurl	Version 7.9.3
Curl Libcurl	Version 7.9.5
Curl Libcurl	Version 7.9.6
Curl Libcurl	Version 7.9.7
Curl Libcurl	Version 7.9.8
Curl Libcurl	Version 7.9
Libcurl Libcurl	Version 7.12.1
Libcurl Libcurl	Version 7.12.2
Libcurl Libcurl	Version 7.12.3
Libcurl Libcurl	Version 7.12
Libcurl Libcurl	Version 7.13.1
Libcurl Libcurl	Version 7.13.2
Libcurl Libcurl	Version 7.13
Libcurl Libcurl	Version 7.14.1
Libcurl Libcurl	Version 7.14
Libcurl Libcurl	Version 7.15.1
Libcurl Libcurl	Version 7.15.2
Libcurl Libcurl	Version 7.15.3
Libcurl Libcurl	Version 7.15
Libcurl Libcurl	Version 7.16.3

Related CWEs

CWE-310

References (56)

http://curl.haxx.se/CVE-2009-2417/curl-7.10.6-CVE-2009-2417.patch

Source: secalert@redhat.com

Patch

http://curl.haxx.se/CVE-2009-2417/curl-7.11.0-CVE-2009-2417.patch

Source: secalert@redhat.com

Patch

http://curl.haxx.se/CVE-2009-2417/curl-7.12.1-CVE-2009-2417.patch

Source: secalert@redhat.com

Patch

http://curl.haxx.se/CVE-2009-2417/curl-7.15.1-CVE-2009-2417.patch

Source: secalert@redhat.com

Patch

http://curl.haxx.se/CVE-2009-2417/curl-7.15.5-CVE-2009-2417.patch

Source: secalert@redhat.com

Patch

http://curl.haxx.se/CVE-2009-2417/curl-7.16.4-CVE-2009-2417.patch

Source: secalert@redhat.com

PatchVendor Advisory

http://curl.haxx.se/CVE-2009-2417/curl-7.18.1-CVE-2009-2417.patch

Source: secalert@redhat.com

Patch

http://curl.haxx.se/CVE-2009-2417/curl-7.19.0-CVE-2009-2417.patch

Source: secalert@redhat.com

Patch

http://curl.haxx.se/CVE-2009-2417/curl-7.19.5-CVE-2009-2417.patch

Source: secalert@redhat.com

Patch

http://curl.haxx.se/docs/adv_20090812.txt

Source: secalert@redhat.com

Vendor Advisory

http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html

Source: secalert@redhat.com

http://secunia.com/advisories/36238

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/36475

Source: secalert@redhat.com

http://secunia.com/advisories/37471

Source: secalert@redhat.com

http://secunia.com/advisories/45047

Source: secalert@redhat.com

http://shibboleth.internet2.edu/secadv/secadv_20090817.txt

Source: secalert@redhat.com

http://support.apple.com/kb/HT4077

Source: secalert@redhat.com

http://wiki.rpath.com/Advisories:rPSA-2009-0124

Source: secalert@redhat.com

http://www.securityfocus.com/archive/1/506055/100/0/threaded

Source: secalert@redhat.com

http://www.securityfocus.com/archive/1/507985/100/0/threaded

Source: secalert@redhat.com

http://www.securityfocus.com/bid/36032

Source: secalert@redhat.com

http://www.ubuntu.com/usn/USN-1158-1

Source: secalert@redhat.com

http://www.vmware.com/security/advisories/VMSA-2009-0016.html

Source: secalert@redhat.com

http://www.vupen.com/english/advisories/2009/2263

Source: secalert@redhat.com

Vendor Advisory

http://www.vupen.com/english/advisories/2009/3316

Source: secalert@redhat.com

https://exchange.xforce.ibmcloud.com/vulnerabilities/52405

Source: secalert@redhat.com

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10114

Source: secalert@redhat.com

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8542

Source: secalert@redhat.com

http://curl.haxx.se/CVE-2009-2417/curl-7.10.6-CVE-2009-2417.patch