CVE-2009-2409 Detail

CVE-2009-2409

CVE Descriptions

The Network Security Services (NSS) library before 3.12.3, as used in Firefox; GnuTLS before 2.6.4 and 2.7.4; OpenSSL 0.9.8 through 0.9.8k; and other products support MD2 with X.509 certificates, which might allow remote attackers to spoof certificates by using MD2 design flaws to generate a hash collision in less than brute-force time. NOTE: the scope of this issue is currently limited because the amount of computation required is still large.

CVE Informations

Related Weaknesses

CWE-ID	Weakness Name	Source
CWE-295	Improper Certificate Validation The product does not validate, or incorrectly validates, a certificate.

Metrics

Metrics	Score	Severity	CVSS Vector	Source
V2	5.1		AV:N/AC:H/Au:N/C:P/I:P/A:P	[email protected]

EPSS

EPSS is a scoring model that predicts the likelihood of a vulnerability being exploited.

EPSS Score

The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.

EPSS Percentile

The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.

EPSS First.org

Products Mentioned

Configuraton 0

Gnu>>Gnutls >> Version To (excluding) 2.6.4

Gnu>>Gnutls >> Version - (Open CPE detail)
Gnu>>Gnutls >> Version 1.0.16 (Open CPE detail)
Gnu>>Gnutls >> Version 1.0.17 (Open CPE detail)
Gnu>>Gnutls >> Version 1.0.18 (Open CPE detail)
Gnu>>Gnutls >> Version 1.0.19 (Open CPE detail)
Gnu>>Gnutls >> Version 1.0.20 (Open CPE detail)
Gnu>>Gnutls >> Version 1.0.21 (Open CPE detail)
Gnu>>Gnutls >> Version 1.0.22 (Open CPE detail)
Gnu>>Gnutls >> Version 1.0.23 (Open CPE detail)
Gnu>>Gnutls >> Version 1.0.24 (Open CPE detail)
Gnu>>Gnutls >> Version 1.0.25 (Open CPE detail)
Gnu>>Gnutls >> Version 1.1.13 (Open CPE detail)
Gnu>>Gnutls >> Version 1.1.14 (Open CPE detail)
Gnu>>Gnutls >> Version 1.1.15 (Open CPE detail)
Gnu>>Gnutls >> Version 1.1.16 (Open CPE detail)
Gnu>>Gnutls >> Version 1.1.17 (Open CPE detail)
Gnu>>Gnutls >> Version 1.1.18 (Open CPE detail)
Gnu>>Gnutls >> Version 1.1.19 (Open CPE detail)
Gnu>>Gnutls >> Version 1.1.20 (Open CPE detail)
Gnu>>Gnutls >> Version 1.1.21 (Open CPE detail)
Gnu>>Gnutls >> Version 1.1.22 (Open CPE detail)
Gnu>>Gnutls >> Version 1.1.23 (Open CPE detail)
Gnu>>Gnutls >> Version 1.2.0 (Open CPE detail)
Gnu>>Gnutls >> Version 1.2.1 (Open CPE detail)
Gnu>>Gnutls >> Version 1.2.2 (Open CPE detail)
Gnu>>Gnutls >> Version 1.2.3 (Open CPE detail)
Gnu>>Gnutls >> Version 1.2.4 (Open CPE detail)
Gnu>>Gnutls >> Version 1.2.5 (Open CPE detail)
Gnu>>Gnutls >> Version 1.2.6 (Open CPE detail)
Gnu>>Gnutls >> Version 1.2.7 (Open CPE detail)
Gnu>>Gnutls >> Version 1.2.8 (Open CPE detail)
Gnu>>Gnutls >> Version 1.2.8.1a1 (Open CPE detail)
Gnu>>Gnutls >> Version 1.2.9 (Open CPE detail)
Gnu>>Gnutls >> Version 1.2.10 (Open CPE detail)
Gnu>>Gnutls >> Version 1.2.11 (Open CPE detail)
Gnu>>Gnutls >> Version 1.3.0 (Open CPE detail)
Gnu>>Gnutls >> Version 1.3.1 (Open CPE detail)
Gnu>>Gnutls >> Version 1.3.2 (Open CPE detail)
Gnu>>Gnutls >> Version 1.3.3 (Open CPE detail)
Gnu>>Gnutls >> Version 1.3.4 (Open CPE detail)
Gnu>>Gnutls >> Version 1.3.5 (Open CPE detail)
Gnu>>Gnutls >> Version 1.4.0 (Open CPE detail)
Gnu>>Gnutls >> Version 1.4.1 (Open CPE detail)
Gnu>>Gnutls >> Version 1.4.2 (Open CPE detail)
Gnu>>Gnutls >> Version 1.4.3 (Open CPE detail)
Gnu>>Gnutls >> Version 1.4.4 (Open CPE detail)
Gnu>>Gnutls >> Version 1.4.5 (Open CPE detail)
Gnu>>Gnutls >> Version 1.5.0 (Open CPE detail)
Gnu>>Gnutls >> Version 1.5.1 (Open CPE detail)
Gnu>>Gnutls >> Version 1.5.2 (Open CPE detail)
Gnu>>Gnutls >> Version 1.5.3 (Open CPE detail)
Gnu>>Gnutls >> Version 1.5.4 (Open CPE detail)
Gnu>>Gnutls >> Version 1.5.5 (Open CPE detail)
Gnu>>Gnutls >> Version 1.6.0 (Open CPE detail)
Gnu>>Gnutls >> Version 1.6.1 (Open CPE detail)
Gnu>>Gnutls >> Version 1.6.2 (Open CPE detail)
Gnu>>Gnutls >> Version 1.6.3 (Open CPE detail)
Gnu>>Gnutls >> Version 1.7.0 (Open CPE detail)
Gnu>>Gnutls >> Version 1.7.1 (Open CPE detail)
Gnu>>Gnutls >> Version 1.7.2 (Open CPE detail)
Gnu>>Gnutls >> Version 1.7.3 (Open CPE detail)
Gnu>>Gnutls >> Version 1.7.4 (Open CPE detail)
Gnu>>Gnutls >> Version 1.7.5 (Open CPE detail)
Gnu>>Gnutls >> Version 1.7.6 (Open CPE detail)
Gnu>>Gnutls >> Version 1.7.7 (Open CPE detail)
Gnu>>Gnutls >> Version 1.7.8 (Open CPE detail)
Gnu>>Gnutls >> Version 1.7.9 (Open CPE detail)
Gnu>>Gnutls >> Version 1.7.10 (Open CPE detail)
Gnu>>Gnutls >> Version 1.7.11 (Open CPE detail)
Gnu>>Gnutls >> Version 1.7.12 (Open CPE detail)
Gnu>>Gnutls >> Version 1.7.13 (Open CPE detail)
Gnu>>Gnutls >> Version 1.7.14 (Open CPE detail)
Gnu>>Gnutls >> Version 1.7.15 (Open CPE detail)
Gnu>>Gnutls >> Version 1.7.16 (Open CPE detail)
Gnu>>Gnutls >> Version 1.7.17 (Open CPE detail)
Gnu>>Gnutls >> Version 1.7.18 (Open CPE detail)
Gnu>>Gnutls >> Version 1.7.19 (Open CPE detail)
Gnu>>Gnutls >> Version 2.0.0 (Open CPE detail)
Gnu>>Gnutls >> Version 2.0.1 (Open CPE detail)
Gnu>>Gnutls >> Version 2.0.2 (Open CPE detail)
Gnu>>Gnutls >> Version 2.0.3 (Open CPE detail)
Gnu>>Gnutls >> Version 2.0.4 (Open CPE detail)
Gnu>>Gnutls >> Version 2.1.0 (Open CPE detail)
Gnu>>Gnutls >> Version 2.1.1 (Open CPE detail)
Gnu>>Gnutls >> Version 2.1.2 (Open CPE detail)
Gnu>>Gnutls >> Version 2.1.3 (Open CPE detail)
Gnu>>Gnutls >> Version 2.1.4 (Open CPE detail)
Gnu>>Gnutls >> Version 2.1.5 (Open CPE detail)
Gnu>>Gnutls >> Version 2.1.6 (Open CPE detail)
Gnu>>Gnutls >> Version 2.1.7 (Open CPE detail)
Gnu>>Gnutls >> Version 2.1.8 (Open CPE detail)
Gnu>>Gnutls >> Version 2.2.0 (Open CPE detail)
Gnu>>Gnutls >> Version 2.2.1 (Open CPE detail)
Gnu>>Gnutls >> Version 2.2.2 (Open CPE detail)
Gnu>>Gnutls >> Version 2.2.3 (Open CPE detail)
Gnu>>Gnutls >> Version 2.2.4 (Open CPE detail)
Gnu>>Gnutls >> Version 2.2.5 (Open CPE detail)
Gnu>>Gnutls >> Version 2.3.0 (Open CPE detail)
Gnu>>Gnutls >> Version 2.3.1 (Open CPE detail)
Gnu>>Gnutls >> Version 2.3.2 (Open CPE detail)
Gnu>>Gnutls >> Version 2.3.3 (Open CPE detail)
Gnu>>Gnutls >> Version 2.3.4 (Open CPE detail)
Gnu>>Gnutls >> Version 2.3.5 (Open CPE detail)
Gnu>>Gnutls >> Version 2.3.6 (Open CPE detail)
Gnu>>Gnutls >> Version 2.3.7 (Open CPE detail)
Gnu>>Gnutls >> Version 2.3.8 (Open CPE detail)
Gnu>>Gnutls >> Version 2.3.9 (Open CPE detail)
Gnu>>Gnutls >> Version 2.3.10 (Open CPE detail)
Gnu>>Gnutls >> Version 2.3.11 (Open CPE detail)
Gnu>>Gnutls >> Version 2.4.0 (Open CPE detail)
Gnu>>Gnutls >> Version 2.4.1 (Open CPE detail)
Gnu>>Gnutls >> Version 2.4.2 (Open CPE detail)
Gnu>>Gnutls >> Version 2.4.3 (Open CPE detail)
Gnu>>Gnutls >> Version 2.5.0 (Open CPE detail)
Gnu>>Gnutls >> Version 2.6.0 (Open CPE detail)
Gnu>>Gnutls >> Version 2.6.1 (Open CPE detail)
Gnu>>Gnutls >> Version 2.6.2 (Open CPE detail)
Gnu>>Gnutls >> Version 2.6.3 (Open CPE detail)

Gnu>>Gnutls >> Version From (including) 2.7.0 To (excluding) 2.7.4

Gnu>>Gnutls >> Version 2.7.0 (Open CPE detail)
Gnu>>Gnutls >> Version 2.7.1 (Open CPE detail)
Gnu>>Gnutls >> Version 2.7.2 (Open CPE detail)
Gnu>>Gnutls >> Version 2.7.3 (Open CPE detail)

Mozilla>>Network_security_services >> Version To (excluding) 3.12.3

Mozilla>>Network_security_services >> Version - (Open CPE detail)
Mozilla>>Network_security_services >> Version 3.1 (Open CPE detail)
Mozilla>>Network_security_services >> Version 3.1.1 (Open CPE detail)
Mozilla>>Network_security_services >> Version 3.2 (Open CPE detail)
Mozilla>>Network_security_services >> Version 3.2.1 (Open CPE detail)
Mozilla>>Network_security_services >> Version 3.3 (Open CPE detail)
Mozilla>>Network_security_services >> Version 3.3.1 (Open CPE detail)
Mozilla>>Network_security_services >> Version 3.3.2 (Open CPE detail)
Mozilla>>Network_security_services >> Version 3.4 (Open CPE detail)
Mozilla>>Network_security_services >> Version 3.4.1 (Open CPE detail)
Mozilla>>Network_security_services >> Version 3.4.2 (Open CPE detail)
Mozilla>>Network_security_services >> Version 3.4.3 (Open CPE detail)
Mozilla>>Network_security_services >> Version 3.5 (Open CPE detail)
Mozilla>>Network_security_services >> Version 3.6 (Open CPE detail)
Mozilla>>Network_security_services >> Version 3.6.1 (Open CPE detail)
Mozilla>>Network_security_services >> Version 3.7 (Open CPE detail)
Mozilla>>Network_security_services >> Version 3.7.1 (Open CPE detail)
Mozilla>>Network_security_services >> Version 3.7.2 (Open CPE detail)
Mozilla>>Network_security_services >> Version 3.7.3 (Open CPE detail)
Mozilla>>Network_security_services >> Version 3.7.5 (Open CPE detail)
Mozilla>>Network_security_services >> Version 3.7.7 (Open CPE detail)
Mozilla>>Network_security_services >> Version 3.8 (Open CPE detail)
Mozilla>>Network_security_services >> Version 3.9 (Open CPE detail)
Mozilla>>Network_security_services >> Version 3.9.1 (Open CPE detail)
Mozilla>>Network_security_services >> Version 3.9.2 (Open CPE detail)
Mozilla>>Network_security_services >> Version 3.9.3 (Open CPE detail)
Mozilla>>Network_security_services >> Version 3.9.4 (Open CPE detail)
Mozilla>>Network_security_services >> Version 3.9.5 (Open CPE detail)
Mozilla>>Network_security_services >> Version 3.10 (Open CPE detail)
Mozilla>>Network_security_services >> Version 3.10.1 (Open CPE detail)
Mozilla>>Network_security_services >> Version 3.10.2 (Open CPE detail)
Mozilla>>Network_security_services >> Version 3.11 (Open CPE detail)
Mozilla>>Network_security_services >> Version 3.11.1 (Open CPE detail)
Mozilla>>Network_security_services >> Version 3.11.2 (Open CPE detail)
Mozilla>>Network_security_services >> Version 3.11.3 (Open CPE detail)
Mozilla>>Network_security_services >> Version 3.11.4 (Open CPE detail)
Mozilla>>Network_security_services >> Version 3.11.5 (Open CPE detail)
Mozilla>>Network_security_services >> Version 3.11.6 (Open CPE detail)
Mozilla>>Network_security_services >> Version 3.11.7 (Open CPE detail)
Mozilla>>Network_security_services >> Version 3.11.8 (Open CPE detail)
Mozilla>>Network_security_services >> Version 3.11.9 (Open CPE detail)
Mozilla>>Network_security_services >> Version 3.11.10 (Open CPE detail)
Mozilla>>Network_security_services >> Version 3.12 (Open CPE detail)
Mozilla>>Network_security_services >> Version 3.12.1 (Open CPE detail)
Mozilla>>Network_security_services >> Version 3.12.2 (Open CPE detail)

Openssl>>Openssl >> Version From (including) 0.9.8 To (including) 0.9.8k

Openssl>>Openssl >> Version 0.9.8 (Open CPE detail)
Openssl>>Openssl >> Version 0.9.8 (Open CPE detail)
Openssl>>Openssl >> Version 0.9.8 (Open CPE detail)
Openssl>>Openssl >> Version 0.9.8 (Open CPE detail)
Openssl>>Openssl >> Version 0.9.8 (Open CPE detail)
Openssl>>Openssl >> Version 0.9.8 (Open CPE detail)
Openssl>>Openssl >> Version 0.9.8 (Open CPE detail)
Openssl>>Openssl >> Version 0.9.8 (Open CPE detail)
Openssl>>Openssl >> Version 0.9.8a (Open CPE detail)
Openssl>>Openssl >> Version 0.9.8b (Open CPE detail)
Openssl>>Openssl >> Version 0.9.8c (Open CPE detail)
Openssl>>Openssl >> Version 0.9.8c-1 (Open CPE detail)
Openssl>>Openssl >> Version 0.9.8d (Open CPE detail)
Openssl>>Openssl >> Version 0.9.8e (Open CPE detail)
Openssl>>Openssl >> Version 0.9.8f (Open CPE detail)
Openssl>>Openssl >> Version 0.9.8g (Open CPE detail)
Openssl>>Openssl >> Version 0.9.8g-9 (Open CPE detail)
Openssl>>Openssl >> Version 0.9.8h (Open CPE detail)
Openssl>>Openssl >> Version 0.9.8i (Open CPE detail)
Openssl>>Openssl >> Version 0.9.8j (Open CPE detail)
Openssl>>Openssl >> Version 0.9.8k (Open CPE detail)

References

http://secunia.com/advisories/36139
Tags : third-party-advisory, x_refsource_SECUNIA

http://secunia.com/advisories/36157
Tags : third-party-advisory, x_refsource_SECUNIA

http://www.mandriva.com/security/advisories?name=MDVSA-2009:197
Tags : vendor-advisory, x_refsource_MANDRIVA

http://www.mandriva.com/security/advisories?name=MDVSA-2009:216
Tags : vendor-advisory, x_refsource_MANDRIVA

https://www.debian.org/security/2009/dsa-1888
Tags : vendor-advisory, x_refsource_DEBIAN

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8594
Tags : vdb-entry, signature, x_refsource_OVAL

http://security.gentoo.org/glsa/glsa-200911-02.xml
Tags : vendor-advisory, x_refsource_GENTOO

http://secunia.com/advisories/36434
Tags : third-party-advisory, x_refsource_SECUNIA

http://security.gentoo.org/glsa/glsa-200912-01.xml
Tags : vendor-advisory, x_refsource_GENTOO

http://www.securitytracker.com/id?1022631
Tags : vdb-entry, x_refsource_SECTRACK

http://secunia.com/advisories/42467
Tags : third-party-advisory, x_refsource_SECUNIA

https://lists.balabit.com/pipermail/syslog-ng-announce/2011-January/000101.html
Tags : mailing-list, x_refsource_MLIST

http://www.redhat.com/support/errata/RHSA-2009-1207.html
Tags : vendor-advisory, x_refsource_REDHAT

http://www.securityfocus.com/archive/1/515055/100/0/threaded
Tags : mailing-list, x_refsource_BUGTRAQ

http://secunia.com/advisories/36669
Tags : third-party-advisory, x_refsource_SECUNIA

http://www.redhat.com/support/errata/RHSA-2009-1432.html
Tags : vendor-advisory, x_refsource_REDHAT

http://www.ubuntu.com/usn/usn-810-1
Tags : vendor-advisory, x_refsource_UBUNTU

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10763
Tags : vdb-entry, signature, x_refsource_OVAL

http://www.mandriva.com/security/advisories?name=MDVSA-2009:258
Tags : vendor-advisory, x_refsource_MANDRIVA

https://usn.ubuntu.com/810-2/
Tags : vendor-advisory, x_refsource_UBUNTU

http://java.sun.com/javase/6/webnotes/6u17.html
Tags : x_refsource_CONFIRM

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7155
Tags : vdb-entry, signature, x_refsource_OVAL

https://lists.balabit.com/pipermail/syslog-ng-announce/2011-January/000102.html
Tags : mailing-list, x_refsource_MLIST

http://www.vupen.com/english/advisories/2010/3126
Tags : vdb-entry, x_refsource_VUPEN

https://rhn.redhat.com/errata/RHSA-2010-0095.html
Tags : vendor-advisory, x_refsource_REDHAT

http://www.vupen.com/english/advisories/2009/3184
Tags : vdb-entry, x_refsource_VUPEN

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2009-2409
Tags : x_refsource_CONFIRM

http://java.sun.com/j2se/1.5.0/ReleaseNotes.html
Tags : x_refsource_CONFIRM

http://www.vmware.com/security/advisories/VMSA-2010-0019.html
Tags : x_refsource_CONFIRM

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6631
Tags : vdb-entry, signature, x_refsource_OVAL

http://lists.apple.com/archives/security-announce/2009/Nov/msg00000.html
Tags : vendor-advisory, x_refsource_APPLE

http://www.mandriva.com/security/advisories?name=MDVSA-2010:084
Tags : vendor-advisory, x_refsource_MANDRIVA

http://secunia.com/advisories/37386
Tags : third-party-advisory, x_refsource_SECUNIA

http://www.vupen.com/english/advisories/2009/2085
Tags : vdb-entry, x_refsource_VUPEN

http://www.debian.org/security/2009/dsa-1874
Tags : vendor-advisory, x_refsource_DEBIAN

http://secunia.com/advisories/36739
Tags : third-party-advisory, x_refsource_SECUNIA

http://support.apple.com/kb/HT3937
Tags : x_refsource_CONFIRM

CVE-2009-2409 : Detail