[Forgot Password]
Login  Register Subscribe

30389

 
 

423868

 
 

244411

 
 

909

 
 

193363

 
 

277

Paid content will be excluded from the download.


Download | Alert*
CVE
view JSON

CVE-2009-4028Date: (C)2009-11-30   (M)2023-12-22


The vio_verify_callback function in viosslfactories.c in MySQL 5.0.x before 5.0.88 and 5.1.x before 5.1.41, when OpenSSL is used, accepts a value of zero for the depth of X.509 certificates, which allows man-in-the-middle attackers to spoof arbitrary SSL-based MySQL servers via a crafted certificate, as demonstrated by a certificate presented by a server linked against the yaSSL library.

CVSS Score and Metrics +CVSS Score and Metrics -

CVSS V2 Severity:
CVSS Score : 6.8
Exploit Score: 8.6
Impact Score: 6.4
 
CVSS V2 Metrics:
Access Vector: NETWORK
Access Complexity: MEDIUM
Authentication: NONE
Confidentiality: PARTIAL
Integrity: PARTIAL
Availability: PARTIAL
  
Reference:
ADV-2010-1107
RHSA-2010:0109
SUSE-SR:2010:011
http://lists.mysql.com/commits/87446
http://www.openwall.com/lists/oss-security/2009/11/19/3
http://marc.info/?l=oss-security&m=125881733826437&w=2
http://www.openwall.com/lists/oss-security/2009/11/23/16
http://bugs.mysql.com/47320
http://dev.mysql.com/doc/refman/5.0/en/news-5-0-88.html
http://dev.mysql.com/doc/refman/5.1/en/news-5-1-41.html
oval:org.mitre.oval:def:10940
oval:org.mitre.oval:def:8510

CPE    28
cpe:/a:mysql:mysql:5.0.10
cpe:/a:mysql:mysql:5.0.16
cpe:/a:mysql:mysql:5.0.17
cpe:/a:mysql:mysql:5.0.15
...
CWE    1
CWE-20
OVAL    8
oval:org.secpod.oval:def:201852
oval:org.secpod.oval:def:101597
oval:org.mitre.oval:def:8510
oval:org.secpod.oval:def:201942
...

© SecPod Technologies