[Forgot Password]
Login  Register Subscribe

23631

 
 

126328

 
 

98250

 
 

909

 
 

79281

 
 

109

Paid content will be excluded from the download.


Download | Alert*
CVE
view XML

CVE-2009-4028

Date: (C)2009-11-30   (M)2017-09-22 


The vio_verify_callback function in viosslfactories.c in MySQL 5.0.x before 5.0.88 and 5.1.x before 5.1.41, when OpenSSL is used, accepts a value of zero for the depth of X.509 certificates, which allows man-in-the-middle attackers to spoof arbitrary SSL-based MySQL servers via a crafted certificate, as demonstrated by a certificate presented by a server linked against the yaSSL library.

CVSS Score: 6.8Access Vector: NETWORK
Exploit Score: 8.6Access Complexity: MEDIUM
Impact Score: 6.4Authentication: NONE
 Confidentiality: PARTIAL
 Integrity: PARTIAL
 Availability: PARTIAL





Reference:
ADV-2010-1107
RHSA-2010:0109
SUSE-SR:2010:011
http://lists.mysql.com/commits/87446
http://www.openwall.com/lists/oss-security/2009/11/19/3
http://marc.info/?l=oss-security&m=125881733826437&w=2
http://www.openwall.com/lists/oss-security/2009/11/23/16
http://bugs.mysql.com/47320
http://dev.mysql.com/doc/refman/5.0/en/news-5-0-88.html
http://dev.mysql.com/doc/refman/5.1/en/news-5-1-41.html

CPE    112
cpe:/a:mysql:mysql:5.0.85
cpe:/a:mysql:mysql:5.0.86
cpe:/a:mysql:mysql:5.0.83
cpe:/a:mysql:mysql:5.0.84
...
CWE    1
CWE-20
OVAL    8
oval:org.secpod.oval:def:101597
oval:org.mitre.oval:def:8510
oval:org.secpod.oval:def:101882
oval:org.secpod.oval:def:300366
...

© 2013 SecPod Technologies