CVE-2009-3490

Severity

68%

Complexity

86%

Confidentiality

106%

GNU Wget before 1.12 does not properly handle a '\0' character in a domain name in the Common Name field of an X.509 certificate, which allows man-in-the-middle remote attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.

CVSS 2.0 Base Score 6.8. CVSS Attack Vector: network. CVSS Attack Complexity: medium. CVSS Vector: (AV:N/AC:M/Au:N/C:P/I:P/A:P).

Overview

Type

GNU

First reported 15 years ago

2009-09-30 15:30:00

Last updated 7 years ago

2017-09-19 01:29:00

Affected Software

GNU wget 1.5.3

1.5.3

GNU wget 1.6

1.6

GNU wget 1.7

1.7

GNU wget 1.7.1

1.7.1

GNU wget 1.8

1.8

GNU wget 1.8.1

1.8.1

GNU wget 1.9

1.9

GNU wget 1.9.1

1.9.1

GNU wget 1.10

1.10

GNU wget 1.10.1

1.10.1

GNU wget 1.10.2

1.10.2

GNU Wget 1.11

1.11

GNU Wget 1.11.1

1.11.1

GNU Wget 1.11.2

1.11.2

GNU Wget 1.11.3

1.11.3

GNU wget

References

[wget-notify] 20090805 [bug #27183] Wget likely suffers from the \0 SSL cert vulnerability

http://hg.addictivecode.org/wget/mainline/rev/1eab157d3be7

http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705

[oss-security] 20090903 More CVE-2009-2408 like issues

[oss-security] 20090923 Re: More CVE-2009-2408 like issues

[bug-wget] 20090922 Release: GNU Wget 1.12

36540

Vendor Advisory

36205

ADV-2009-2498