NetSight
IP …
medium5.9

CVE-2009-2408

Mozilla Network Security Services (NSS) before 3.12.3, Firefox before 3.0.13, Thunderbird before 2.0.0.23, and SeaMonkey before 1.1.18 do not properly handle a…

Impact

Mozilla Network Security Services (NSS) before 3.12.3, Firefox before 3.0.13, Thunderbird before 2.0.0.23, and SeaMonkey before 1.1.18 do not properly handle a '\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority. NOTE: this was originally reported for Firefox before 3.5.

Affected products

VendorProductAffected versions
MozillaFirefox
before 3.0.13
MozillaNetwork Security Services
before 3.12.3
MozillaSeamonkey
before 1.1.18
MozillaThunderbird
before 2.0.0.23
OpensuseOpensuse
from 10.3 through 11.1
SuseLinux Enterprise
Versions 10.0, 11.0
SuseLinux Enterprise Server
Version 9
DebianDebian Linux
Version 5.0
CanonicalUbuntu Linux
Versions 8.04, 8.10, 9.04

Weakness classification

CWE-295

References