[Forgot Password]
Login  Register Subscribe

30389

 
 

423868

 
 

244625

 
 

909

 
 

193379

 
 

277

Paid content will be excluded from the download.


Download | Alert*
CVE
view JSON

CVE-2009-4034Date: (C)2009-12-15   (M)2023-12-22


PostgreSQL 7.4.x before 7.4.27, 8.0.x before 8.0.23, 8.1.x before 8.1.19, 8.2.x before 8.2.15, 8.3.x before 8.3.9, and 8.4.x before 8.4.2 does not properly handle a '' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which (1) allows man-in-the-middle attackers to spoof arbitrary SSL-based PostgreSQL servers via a crafted server certificate issued by a legitimate Certification Authority, and (2) allows remote attackers to bypass intended client-hostname restrictions via a crafted client certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.

CVSS Score and Metrics +CVSS Score and Metrics -

CVSS V2 Severity:
CVSS Score : 5.8
Exploit Score: 8.6
Impact Score: 4.9
 
CVSS V2 Metrics:
Access Vector: NETWORK
Access Complexity: MEDIUM
Authentication: NONE
Confidentiality: NONE
Integrity: PARTIAL
Availability: PARTIAL
  
Reference:
SECTRACK-1023325
http://www.securityfocus.com/archive/1/509917/100/0/threaded
BID-37334
SECUNIA-37663
OSVDB-61038
ADV-2009-3519
FEDORA-2009-13363
FEDORA-2009-13381
HPSBMU02781
MDVSA-2009:333
SUSE-SR:2010:001
http://wiki.rpath.com/wiki/Advisories:rPSA-2010-0012
http://www.postgresql.org/docs/current/static/release-7-4-27.html
http://www.postgresql.org/docs/current/static/release-8-0-23.html
http://www.postgresql.org/docs/current/static/release-8-1-19.html
http://www.postgresql.org/docs/current/static/release-8-2-15.html
http://www.postgresql.org/docs/current/static/release-8-3-9.html
http://www.postgresql.org/docs/current/static/release-8-4-2.html
http://www.postgresql.org/support/security.html

CPE    90
cpe:/a:postgresql:postgresql:7.4.10
cpe:/a:postgresql:postgresql:7.4.11
cpe:/a:postgresql:postgresql:7.4.9
cpe:/a:postgresql:postgresql:7.4.8
...
CWE    1
CWE-310
OVAL    7
oval:org.secpod.oval:def:33761
oval:org.secpod.oval:def:700066
oval:org.mitre.oval:def:6869
oval:org.secpod.oval:def:102503
...

© SecPod Technologies