Secure testing team - Aug 2009 - Bug#542926: CVE-2009-2474: Improper verification of x590v3 certificate with NUL (zero) byte in certain fields

Package: neon27,neon26,neon
Severity: grave
Tags: security

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi,
the following CVE (Common Vulnerabilities & Exposures) id was
published for neon.

CVE-2009-2474[0]:
neon before 0.28.6, when OpenSSL is used, does not properly handle a
''\0'' character in a domain name in the subject''s
Common Name (CN)
field of an X.509 certificate, which allows man-in-the-middle
attackers to spoof arbitrary SSL servers via a crafted certificate
issued by a legitimate Certification Authority, a related issue to
CVE-2009-2408.


If you fix the vulnerability please also make sure to include the
CVE id in your changelog entry.

For further information see:

[0] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2474
    http://security-tracker.debian.net/tracker/CVE-2009-2474
    http://lists.manyfish.co.uk/pipermail/neon/2009-August/001046.html
    http://lists.manyfish.co.uk/pipermail/neon/2009-August/001044.html

Cheers,
Giuseppe

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iEYEARECAAYFAkqPu6EACgkQNxpp46476apIvQCgh/SR333ms4qiHyQOSzs4+8A5
i64AoJXZOzUPPtetame4R2EI7j7dYVhO
=vUEk
-----END PGP SIGNATURE-----