CVE-2008-2809

Impact

Mozilla 1.9 M8 and earlier, Mozilla Firefox 2 before 2.0.0.15, SeaMonkey 1.1.5 and other versions before 1.1.10, Netscape 9.0, and other Mozilla-based web browsers, when a user accepts an SSL server certificate on the basis of the CN domain name in the DN field, regard the certificate as also accepted for all domain names in subjectAltName:dNSName fields, which makes it easier for remote attackers to trick a user into accepting an invalid certificate for a spoofed web site.

Affected products

Weakness classification

References

• NVD record
• CVE.org record
• http://lists.opensuse.org/opensuse-security-announce/2008-07/msg00004.html
• http://nils.toedtmann.net/pub/subjectAltName.txt
• http://rhn.redhat.com/errata/RHSA-2008-0616.html
• http://secunia.com/advisories/30878
• http://secunia.com/advisories/30898
• http://secunia.com/advisories/30903
• http://secunia.com/advisories/30911
• http://secunia.com/advisories/30949
• http://secunia.com/advisories/31005
• http://secunia.com/advisories/31008
• http://secunia.com/advisories/31021
• http://secunia.com/advisories/31023
• http://secunia.com/advisories/31069
• http://secunia.com/advisories/31076
• http://secunia.com/advisories/31183
• http://secunia.com/advisories/31195
• http://secunia.com/advisories/31220
• http://secunia.com/advisories/31253
• http://secunia.com/advisories/31286
• http://secunia.com/advisories/31377
• http://secunia.com/advisories/31403
• http://secunia.com/advisories/33433
• http://secunia.com/advisories/34501
• http://security.gentoo.org/glsa/glsa-200808-03.xml
• http://securityreason.com/securityalert/3498