4

CVE-2008-2809

Mozilla 1.9 M8 and earlier, Mozilla Firefox 2 before 2.0.0.15, SeaMonkey 1.1.5 and other versions before 1.1.10, Netscape 9.0, and other Mozilla-based web browsers, when a user accepts an SSL server certificate on the basis of the CN domain name in the DN field, regard the certificate as also accepted for all domain names in subjectAltName:dNSName fields, which makes it easier for remote attackers to trick a user into accepting an invalid certificate for a spoofed web site.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Mozilla ≫ Firefox Version2.0.0.1
Mozilla ≫ Firefox Version2.0.0.2
Mozilla ≫ Firefox Version2.0.0.3
Mozilla ≫ Firefox Version2.0.0.4
Mozilla ≫ Firefox Version2.0.0.5
Mozilla ≫ Firefox Version2.0.0.6
Mozilla ≫ Firefox Version2.0.0.7
Mozilla ≫ Firefox Version2.0.0.8
Mozilla ≫ Firefox Version2.0.0.9
Mozilla ≫ Firefox Version2.0.0.10
Mozilla ≫ Firefox Version2.0.0.11
Mozilla ≫ Firefox Version2.0.0.12
Mozilla ≫ Firefox Version2.0.0.13
Mozilla ≫ Firefox Version2.0.0.14
Mozilla ≫ Geckb Updatem8 Version <= 1.9
Mozilla ≫ Seamonkey Version <= 1.0.9
Mozilla ≫ Seamonkey Version1.1.5
Netscape ≫ Navigator Version9.0
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.24% 0.653
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 4 4.9 4.9
AV:N/AC:H/Au:N/C:N/I:P/A:P
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

http://nils.toedtmann.net/pub/subjectAltName.txt
http://securityreason.com/securityalert/3498
http://www.securityfocus.com/archive/1/483929/100/100/threaded
http://www.securityfocus.com/archive/1/483937/100/100/threaded
http://www.securityfocus.com/archive/1/483960/100/100/threaded
http://secunia.com/advisories/31253
http://secunia.com/advisories/33433
http://www.debian.org/security/2008/dsa-1621
http://www.debian.org/security/2009/dsa-1697
http://www.mandriva.com/security/advisories?name=MDVSA-2008:155
http://secunia.com/advisories/31023
http://secunia.com/advisories/31377
http://security.gentoo.org/glsa/glsa-200808-03.xml
http://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.383152
http://rhn.redhat.com/errata/RHSA-2008-0616.html
http://secunia.com/advisories/31183
http://secunia.com/advisories/31195
http://secunia.com/advisories/31220
http://secunia.com/advisories/31286
http://secunia.com/advisories/31403
http://secunia.com/advisories/34501
http://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.410484
http://sunsolve.sun.com/search/document.do?assetkey=1-26-256408-1
http://www.debian.org/security/2008/dsa-1615
http://www.ubuntu.com/usn/usn-629-1
http://www.vupen.com/english/advisories/2009/0977
https://www.redhat.com/archives/fedora-package-announce/2008-August/msg00125.html
https://www.redhat.com/archives/fedora-package-announce/2008-August/msg00144.html
http://lists.opensuse.org/opensuse-security-announce/2008-07/msg00004.html
http://secunia.com/advisories/30878
http://secunia.com/advisories/30898
http://secunia.com/advisories/30903
http://secunia.com/advisories/30911
Vendor Advisory
http://secunia.com/advisories/30949
http://secunia.com/advisories/31005
http://secunia.com/advisories/31008
http://secunia.com/advisories/31021
http://secunia.com/advisories/31069
http://secunia.com/advisories/31076
http://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.384911
http://wiki.rpath.com/Advisories:rPSA-2008-0216
http://www.debian.org/security/2008/dsa-1607
http://www.mandriva.com/security/advisories?name=MDVSA-2008:136
http://www.mozilla.org/projects/security/known-vulnerabilities.html#firefox2.0.0.15
http://www.redhat.com/support/errata/RHSA-2008-0547.html
http://www.redhat.com/support/errata/RHSA-2008-0549.html
http://www.redhat.com/support/errata/RHSA-2008-0569.html
http://www.securityfocus.com/archive/1/494080/100/0/threaded
http://www.securityfocus.com/bid/30038
http://www.securitytracker.com/id?1020419
http://www.ubuntu.com/usn/usn-619-1
http://www.vupen.com/english/advisories/2008/1993/references
https://issues.rpath.com/browse/RPL-2646
https://www.redhat.com/archives/fedora-package-announce/2008-July/msg00207.html
https://www.redhat.com/archives/fedora-package-announce/2008-July/msg00288.html
https://www.redhat.com/archives/fedora-package-announce/2008-July/msg00295.html
http://securitytracker.com/id?1018979
http://www.mozilla.org/security/announce/2008/mfsa2008-31.html
https://bugzilla.mozilla.org/show_bug.cgi?id=240261
https://bugzilla.mozilla.org/show_bug.cgi?id=327181
https://bugzilla.mozilla.org/show_bug.cgi?id=402347
https://exchange.xforce.ibmcloud.com/vulnerabilities/43524
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10205