NetSight
IP …
medium6.8

CVE-2009-4028

The vio_verify_callback function in viosslfactories.c in MySQL 5.0.x before 5.0.88 and 5.1.x before 5.1.41, when OpenSSL is used, accepts a value of zero for t…

Impact

The vio_verify_callback function in viosslfactories.c in MySQL 5.0.x before 5.0.88 and 5.1.x before 5.1.41, when OpenSSL is used, accepts a value of zero for the depth of X.509 certificates, which allows man-in-the-middle attackers to spoof arbitrary SSL-based MySQL servers via a crafted certificate, as demonstrated by a certificate presented by a server linked against the yaSSL library.

Affected products

VendorProductAffected versions
MysqlMysql
through 5.0.87
Versions 5.0.0, 5.0.1, 5.0.2, 5.0.3, 5.0.4
OracleMysql
Versions 5.0.0, 5.0.3, 5.0.6, 5.0.7, 5.0.8, 5.0.11

Weakness classification

CWE-20

References