362 matches found
DSA-1985-1 sendmail - insufficient input validation
Bulletin has no description...
CVE-2009-4565
sendmail before 8.14.4 does not properly handle a '\0' character in a Common Name CN field of an X.509 certificate, which 1 allows man-in-the-middle attackers to spoof arbitrary SSL-based SMTP servers via a crafted server certificate issued by a legitimate Certification Authority, and 2 allows...
CVE-2009-3942
Technical details about CVE-2009-3942 are not publicly available in the provided connected documents. The materials do not specify affected products, versions, root cause, or remediation. Monitor for updates and new advisories.
Design/Logic Flaw
Certificate Assistant in Apple Mac OS X before 10.6.2 does not properly handle a '\0' character in a domain name in the subject's Common Name CN field of an X.509 certificate, which might allow man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a...
SuSE 10 Security Update : neon (ZYPP Patch Number 6548)
neon did not properly handle embedded NUL characters in X.509 certificates when comparing host names. Attackers could exploit that to spoof SSL servers. CVE-2009-2408 Specially crafted XML documents that contain a large number of nested entity references could cause neon to consume large amounts ...
Design/Logic Flaw
muttssl.c in mutt 1.5.16 and other versions before 1.5.19, when OpenSSL is used, does not verify the domain name in the subject's Common Name CN field of an X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate...
CVE-2009-3766
muttssl.c in mutt 1.5.16 and other versions before 1.5.19, when OpenSSL is used, does not verify the domain name in the subject's Common Name CN field of an X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate...
Mandrake Security Advisory MDVSA-2009:228 (libneon)
The remote host is missing an update to libneon announced via advisory MDVSA-2009:228. SPDX-FileCopyrightText: 2009 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only OR...
Mandrake Security Advisory MDVSA-2009:201 (fetchmail)
The remote host is missing an update to fetchmail announced via advisory MDVSA-2009:201. SPDX-FileCopyrightText: 2009 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only OR...
CVE-2009-2730
CVE-2009-2730 affects GnuTLS libgnutls where a NULL character in a domain name (CN or SAN) of an X.509 certificate is not handled correctly, enabling MITM spoofing of SSL servers if a crafted cert from a trusted CA is issued. Affected product/version: libgnutls in GnuTLS prior to 2.8.2. Impact: p...
CVE-2009-2730
libgnutls in GnuTLS before 2.8.2 does not properly handle a '\0' character in a domain name in the subject's 1 Common Name CN or 2 Subject Alternative Name SAN field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued b...
Design/Logic Flaw
socket.c in fetchmail before 6.3.11 does not properly handle a '\0' character in a domain name in the subject's Common Name CN field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification...
Firefox SSL Server Spoofing Vulnerability - Windows
Mozilla Firefox browser is prone to SSL server spoofing vulnerability. SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
OpenSSL/GnuTLS SSL Server Spoofing Vulnerability - Windows
OpenSSL/GnuTLS is prone to an SSL server spoofing vulnerability. SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
CVE-2009-2408
Mozilla Network Security Services NSS before 3.12.3, Firefox before 3.0.13, Thunderbird before 2.0.0.23, and SeaMonkey before 1.1.18 do not properly handle a '\0' character in a domain name in the subject's Common Name CN field of an X.509 certificate, which allows man-in-the-middle attackers to...
InstallShield Update Services server spoofing
Server's identity is not checked during update rules download...
Dropbear dbclient SSH server spoofing
User is not adequately warned on server crypto key mismatch...
MUTE file sharing peering networks server spoofing
By spoofing mWebCache it's possible to make client to connect to specified IP address...
Microsoft IIS 5.0 - '500-100.asp' Server Name Spoof
/ ==================================================================================== || || || || || || || || || || ==================================================================================== Name: IIS 5.x and IIS 6.0 Server Name Spoof PoC File: IIS5.xandIIS6.0ServerNameSpoof.c...