CVE-2009-2417

curl: incorrect verification of SSL certificate with NUL in name

Severity Score

5.9

*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

lib/ssluse.c in cURL and libcurl 7.4 through 7.19.5, when OpenSSL is used, does not properly handle a '\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.

lib/ssluse.c en cURL y libcurl v7.4 hasta v7.19.5, cuando se usa OpenSSL, no maneja de forma aecuada el caracter '\0' en un nombre de dominio en el campo sujeto del Common Name (CN) de un certificado X.509, lo que permite a atacantes de hombre en el medio hacer un spoofing de servidores SSL a través de la un certificado de una autoridad de Certificación legítima, manipulado, relativo a CVE_2009-2408.

Richard Silverman discovered that when doing GSSAPI authentication, libcurl unconditionally performs credential delegation, handing the server a copy of the client's security credential. Wesley Miaw discovered that when zlib is enabled, libcurl does not properly restrict the amount of callback data sent to an application that requests automatic decompression. This might allow an attacker to cause a denial of service via an application crash or possibly execute arbitrary code with the privilege of the application. This issue only affected Ubuntu 8.04 LTS and Ubuntu 10.04 LTS. Various other issues were also addressed.

*Credits: N/A

CVSS Scores

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Attack Vector

Network

Attack Complexity

Low

Authentication

None

Confidentiality

Partial

Integrity

Partial

Availability

Partial

Attack Vector

Network

Attack Complexity

High

Authentication

None

Confidentiality

Partial

Integrity

Partial

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2009-07-09 CVE Reserved
2009-08-14 CVE Published
2024-08-07 CVE Updated
2025-05-04 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-310: Cryptographic Issues

CAPEC

References (30)

URL	Tag	Source
http://secunia.com/advisories/36475	Third Party Advisory
http://secunia.com/advisories/37471	Third Party Advisory
http://secunia.com/advisories/45047	Third Party Advisory
http://shibboleth.internet2.edu/secadv/secadv_20090817.txt	X_refsource_confirm
http://support.apple.com/kb/HT4077	X_refsource_confirm
http://wiki.rpath.com/Advisories:rPSA-2009-0124	X_refsource_confirm
http://www.securityfocus.com/archive/1/506055/100/0/threaded	Mailing List
http://www.securityfocus.com/archive/1/507985/100/0/threaded	Mailing List
http://www.securityfocus.com/bid/36032	Vdb Entry
http://www.vmware.com/security/advisories/VMSA-2009-0016.html	X_refsource_confirm
http://www.vupen.com/english/advisories/2009/3316	Vdb Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/52405	Vdb Entry
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10114	Signature
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8542	Signature

URL	Date	SRC

URL	Date	SRC
http://curl.haxx.se/CVE-2009-2417/curl-7.10.6-CVE-2009-2417.patch	2018-10-10
http://curl.haxx.se/CVE-2009-2417/curl-7.11.0-CVE-2009-2417.patch	2018-10-10
http://curl.haxx.se/CVE-2009-2417/curl-7.12.1-CVE-2009-2417.patch	2018-10-10
http://curl.haxx.se/CVE-2009-2417/curl-7.15.1-CVE-2009-2417.patch	2018-10-10
http://curl.haxx.se/CVE-2009-2417/curl-7.15.5-CVE-2009-2417.patch	2018-10-10
http://curl.haxx.se/CVE-2009-2417/curl-7.16.4-CVE-2009-2417.patch	2018-10-10
http://curl.haxx.se/CVE-2009-2417/curl-7.18.1-CVE-2009-2417.patch	2018-10-10
http://curl.haxx.se/CVE-2009-2417/curl-7.19.0-CVE-2009-2417.patch	2018-10-10
http://curl.haxx.se/CVE-2009-2417/curl-7.19.5-CVE-2009-2417.patch	2018-10-10

URL	Date	SRC
http://curl.haxx.se/docs/adv_20090812.txt	2018-10-10
http://lists.apple.com/archives/security-announce/2010//Mar/msg00001.html	2018-10-10
http://secunia.com/advisories/36238	2018-10-10
http://www.ubuntu.com/usn/USN-1158-1	2018-10-10
http://www.vupen.com/english/advisories/2009/2263	2018-10-10
https://access.redhat.com/security/cve/CVE-2009-2417	2009-08-13
https://bugzilla.redhat.com/show_bug.cgi?id=516181	2009-08-13

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Curl Search vendor "Curl"		Libcurl Search vendor "Curl" for product "Libcurl"				7.4 Search vendor "Curl" for product "Libcurl" and version "7.4"		-		Affected
Curl Search vendor "Curl"		Libcurl Search vendor "Curl" for product "Libcurl"				7.4.1 Search vendor "Curl" for product "Libcurl" and version "7.4.1"		-		Affected
Curl Search vendor "Curl"		Libcurl Search vendor "Curl" for product "Libcurl"				7.4.2 Search vendor "Curl" for product "Libcurl" and version "7.4.2"		-		Affected
Curl Search vendor "Curl"		Libcurl Search vendor "Curl" for product "Libcurl"				7.5 Search vendor "Curl" for product "Libcurl" and version "7.5"		-		Affected
Curl Search vendor "Curl"		Libcurl Search vendor "Curl" for product "Libcurl"				7.5.1 Search vendor "Curl" for product "Libcurl" and version "7.5.1"		-		Affected
Curl Search vendor "Curl"		Libcurl Search vendor "Curl" for product "Libcurl"				7.5.2 Search vendor "Curl" for product "Libcurl" and version "7.5.2"		-		Affected
Curl Search vendor "Curl"		Libcurl Search vendor "Curl" for product "Libcurl"				7.6 Search vendor "Curl" for product "Libcurl" and version "7.6"		-		Affected
Curl Search vendor "Curl"		Libcurl Search vendor "Curl" for product "Libcurl"				7.6.1 Search vendor "Curl" for product "Libcurl" and version "7.6.1"		-		Affected
Curl Search vendor "Curl"		Libcurl Search vendor "Curl" for product "Libcurl"				7.7 Search vendor "Curl" for product "Libcurl" and version "7.7"		-		Affected
Curl Search vendor "Curl"		Libcurl Search vendor "Curl" for product "Libcurl"				7.7.1 Search vendor "Curl" for product "Libcurl" and version "7.7.1"		-		Affected
Curl Search vendor "Curl"		Libcurl Search vendor "Curl" for product "Libcurl"				7.7.2 Search vendor "Curl" for product "Libcurl" and version "7.7.2"		-		Affected
Curl Search vendor "Curl"		Libcurl Search vendor "Curl" for product "Libcurl"				7.7.3 Search vendor "Curl" for product "Libcurl" and version "7.7.3"		-		Affected
Curl Search vendor "Curl"		Libcurl Search vendor "Curl" for product "Libcurl"				7.8 Search vendor "Curl" for product "Libcurl" and version "7.8"		-		Affected
Curl Search vendor "Curl"		Libcurl Search vendor "Curl" for product "Libcurl"				7.8.1 Search vendor "Curl" for product "Libcurl" and version "7.8.1"		-		Affected
Curl Search vendor "Curl"		Libcurl Search vendor "Curl" for product "Libcurl"				7.9 Search vendor "Curl" for product "Libcurl" and version "7.9"		-		Affected
Curl Search vendor "Curl"		Libcurl Search vendor "Curl" for product "Libcurl"				7.9.1 Search vendor "Curl" for product "Libcurl" and version "7.9.1"		-		Affected
Curl Search vendor "Curl"		Libcurl Search vendor "Curl" for product "Libcurl"				7.9.2 Search vendor "Curl" for product "Libcurl" and version "7.9.2"		-		Affected
Curl Search vendor "Curl"		Libcurl Search vendor "Curl" for product "Libcurl"				7.9.3 Search vendor "Curl" for product "Libcurl" and version "7.9.3"		-		Affected
Curl Search vendor "Curl"		Libcurl Search vendor "Curl" for product "Libcurl"				7.9.5 Search vendor "Curl" for product "Libcurl" and version "7.9.5"		-		Affected
Curl Search vendor "Curl"		Libcurl Search vendor "Curl" for product "Libcurl"				7.9.6 Search vendor "Curl" for product "Libcurl" and version "7.9.6"		-		Affected
Curl Search vendor "Curl"		Libcurl Search vendor "Curl" for product "Libcurl"				7.9.7 Search vendor "Curl" for product "Libcurl" and version "7.9.7"		-		Affected
Curl Search vendor "Curl"		Libcurl Search vendor "Curl" for product "Libcurl"				7.9.8 Search vendor "Curl" for product "Libcurl" and version "7.9.8"		-		Affected
Curl Search vendor "Curl"		Libcurl Search vendor "Curl" for product "Libcurl"				7.10 Search vendor "Curl" for product "Libcurl" and version "7.10"		-		Affected
Curl Search vendor "Curl"		Libcurl Search vendor "Curl" for product "Libcurl"				7.10.1 Search vendor "Curl" for product "Libcurl" and version "7.10.1"		-		Affected
Curl Search vendor "Curl"		Libcurl Search vendor "Curl" for product "Libcurl"				7.10.2 Search vendor "Curl" for product "Libcurl" and version "7.10.2"		-		Affected
Curl Search vendor "Curl"		Libcurl Search vendor "Curl" for product "Libcurl"				7.10.3 Search vendor "Curl" for product "Libcurl" and version "7.10.3"		-		Affected
Curl Search vendor "Curl"		Libcurl Search vendor "Curl" for product "Libcurl"				7.10.4 Search vendor "Curl" for product "Libcurl" and version "7.10.4"		-		Affected
Curl Search vendor "Curl"		Libcurl Search vendor "Curl" for product "Libcurl"				7.10.5 Search vendor "Curl" for product "Libcurl" and version "7.10.5"		-		Affected
Curl Search vendor "Curl"		Libcurl Search vendor "Curl" for product "Libcurl"				7.10.6 Search vendor "Curl" for product "Libcurl" and version "7.10.6"		-		Affected
Curl Search vendor "Curl"		Libcurl Search vendor "Curl" for product "Libcurl"				7.10.7 Search vendor "Curl" for product "Libcurl" and version "7.10.7"		-		Affected
Curl Search vendor "Curl"		Libcurl Search vendor "Curl" for product "Libcurl"				7.10.8 Search vendor "Curl" for product "Libcurl" and version "7.10.8"		-		Affected
Curl Search vendor "Curl"		Libcurl Search vendor "Curl" for product "Libcurl"				7.11.0 Search vendor "Curl" for product "Libcurl" and version "7.11.0"		-		Affected
Curl Search vendor "Curl"		Libcurl Search vendor "Curl" for product "Libcurl"				7.11.1 Search vendor "Curl" for product "Libcurl" and version "7.11.1"		-		Affected
Curl Search vendor "Curl"		Libcurl Search vendor "Curl" for product "Libcurl"				7.11.2 Search vendor "Curl" for product "Libcurl" and version "7.11.2"		-		Affected
Curl Search vendor "Curl"		Libcurl Search vendor "Curl" for product "Libcurl"				7.12 Search vendor "Curl" for product "Libcurl" and version "7.12"		-		Affected
Curl Search vendor "Curl"		Libcurl Search vendor "Curl" for product "Libcurl"				7.12.0 Search vendor "Curl" for product "Libcurl" and version "7.12.0"		-		Affected
Curl Search vendor "Curl"		Libcurl Search vendor "Curl" for product "Libcurl"				7.12.1 Search vendor "Curl" for product "Libcurl" and version "7.12.1"		-		Affected
Curl Search vendor "Curl"		Libcurl Search vendor "Curl" for product "Libcurl"				7.12.2 Search vendor "Curl" for product "Libcurl" and version "7.12.2"		-		Affected
Curl Search vendor "Curl"		Libcurl Search vendor "Curl" for product "Libcurl"				7.12.3 Search vendor "Curl" for product "Libcurl" and version "7.12.3"		-		Affected
Curl Search vendor "Curl"		Libcurl Search vendor "Curl" for product "Libcurl"				7.13 Search vendor "Curl" for product "Libcurl" and version "7.13"		-		Affected
Curl Search vendor "Curl"		Libcurl Search vendor "Curl" for product "Libcurl"				7.13.1 Search vendor "Curl" for product "Libcurl" and version "7.13.1"		-		Affected
Curl Search vendor "Curl"		Libcurl Search vendor "Curl" for product "Libcurl"				7.13.2 Search vendor "Curl" for product "Libcurl" and version "7.13.2"		-		Affected
Curl Search vendor "Curl"		Libcurl Search vendor "Curl" for product "Libcurl"				7.14 Search vendor "Curl" for product "Libcurl" and version "7.14"		-		Affected
Curl Search vendor "Curl"		Libcurl Search vendor "Curl" for product "Libcurl"				7.14.1 Search vendor "Curl" for product "Libcurl" and version "7.14.1"		-		Affected
Curl Search vendor "Curl"		Libcurl Search vendor "Curl" for product "Libcurl"				7.15 Search vendor "Curl" for product "Libcurl" and version "7.15"		-		Affected
Curl Search vendor "Curl"		Libcurl Search vendor "Curl" for product "Libcurl"				7.15.1 Search vendor "Curl" for product "Libcurl" and version "7.15.1"		-		Affected
Curl Search vendor "Curl"		Libcurl Search vendor "Curl" for product "Libcurl"				7.15.2 Search vendor "Curl" for product "Libcurl" and version "7.15.2"		-		Affected
Curl Search vendor "Curl"		Libcurl Search vendor "Curl" for product "Libcurl"				7.15.3 Search vendor "Curl" for product "Libcurl" and version "7.15.3"		-		Affected
Curl Search vendor "Curl"		Libcurl Search vendor "Curl" for product "Libcurl"				7.16.3 Search vendor "Curl" for product "Libcurl" and version "7.16.3"		-		Affected
Curl Search vendor "Curl"		Libcurl Search vendor "Curl" for product "Libcurl"				7.17.0 Search vendor "Curl" for product "Libcurl" and version "7.17.0"		-		Affected
Curl Search vendor "Curl"		Libcurl Search vendor "Curl" for product "Libcurl"				7.17.1 Search vendor "Curl" for product "Libcurl" and version "7.17.1"		-		Affected
Curl Search vendor "Curl"		Libcurl Search vendor "Curl" for product "Libcurl"				7.18.0 Search vendor "Curl" for product "Libcurl" and version "7.18.0"		-		Affected
Curl Search vendor "Curl"		Libcurl Search vendor "Curl" for product "Libcurl"				7.18.1 Search vendor "Curl" for product "Libcurl" and version "7.18.1"		-		Affected
Curl Search vendor "Curl"		Libcurl Search vendor "Curl" for product "Libcurl"				7.18.2 Search vendor "Curl" for product "Libcurl" and version "7.18.2"		-		Affected
Curl Search vendor "Curl"		Libcurl Search vendor "Curl" for product "Libcurl"				7.19.0 Search vendor "Curl" for product "Libcurl" and version "7.19.0"		-		Affected
Curl Search vendor "Curl"		Libcurl Search vendor "Curl" for product "Libcurl"				7.19.1 Search vendor "Curl" for product "Libcurl" and version "7.19.1"		-		Affected
Curl Search vendor "Curl"		Libcurl Search vendor "Curl" for product "Libcurl"				7.19.2 Search vendor "Curl" for product "Libcurl" and version "7.19.2"		-		Affected
Curl Search vendor "Curl"		Libcurl Search vendor "Curl" for product "Libcurl"				7.19.3 Search vendor "Curl" for product "Libcurl" and version "7.19.3"		-		Affected
Curl Search vendor "Curl"		Libcurl Search vendor "Curl" for product "Libcurl"				7.19.4 Search vendor "Curl" for product "Libcurl" and version "7.19.4"		-		Affected
Curl Search vendor "Curl"		Libcurl Search vendor "Curl" for product "Libcurl"				7.19.5 Search vendor "Curl" for product "Libcurl" and version "7.19.5"		-		Affected
Libcurl Search vendor "Libcurl"		Libcurl Search vendor "Libcurl" for product "Libcurl"				7.12 Search vendor "Libcurl" for product "Libcurl" and version "7.12"		-		Affected
Libcurl Search vendor "Libcurl"		Libcurl Search vendor "Libcurl" for product "Libcurl"				7.12.1 Search vendor "Libcurl" for product "Libcurl" and version "7.12.1"		-		Affected
Libcurl Search vendor "Libcurl"		Libcurl Search vendor "Libcurl" for product "Libcurl"				7.12.2 Search vendor "Libcurl" for product "Libcurl" and version "7.12.2"		-		Affected
Libcurl Search vendor "Libcurl"		Libcurl Search vendor "Libcurl" for product "Libcurl"				7.12.3 Search vendor "Libcurl" for product "Libcurl" and version "7.12.3"		-		Affected
Libcurl Search vendor "Libcurl"		Libcurl Search vendor "Libcurl" for product "Libcurl"				7.13 Search vendor "Libcurl" for product "Libcurl" and version "7.13"		-		Affected
Libcurl Search vendor "Libcurl"		Libcurl Search vendor "Libcurl" for product "Libcurl"				7.13.1 Search vendor "Libcurl" for product "Libcurl" and version "7.13.1"		-		Affected
Libcurl Search vendor "Libcurl"		Libcurl Search vendor "Libcurl" for product "Libcurl"				7.13.2 Search vendor "Libcurl" for product "Libcurl" and version "7.13.2"		-		Affected
Libcurl Search vendor "Libcurl"		Libcurl Search vendor "Libcurl" for product "Libcurl"				7.14 Search vendor "Libcurl" for product "Libcurl" and version "7.14"		-		Affected
Libcurl Search vendor "Libcurl"		Libcurl Search vendor "Libcurl" for product "Libcurl"				7.14.1 Search vendor "Libcurl" for product "Libcurl" and version "7.14.1"		-		Affected
Libcurl Search vendor "Libcurl"		Libcurl Search vendor "Libcurl" for product "Libcurl"				7.15 Search vendor "Libcurl" for product "Libcurl" and version "7.15"		-		Affected
Libcurl Search vendor "Libcurl"		Libcurl Search vendor "Libcurl" for product "Libcurl"				7.15.1 Search vendor "Libcurl" for product "Libcurl" and version "7.15.1"		-		Affected
Libcurl Search vendor "Libcurl"		Libcurl Search vendor "Libcurl" for product "Libcurl"				7.15.2 Search vendor "Libcurl" for product "Libcurl" and version "7.15.2"		-		Affected
Libcurl Search vendor "Libcurl"		Libcurl Search vendor "Libcurl" for product "Libcurl"				7.15.3 Search vendor "Libcurl" for product "Libcurl" and version "7.15.3"		-		Affected
Libcurl Search vendor "Libcurl"		Libcurl Search vendor "Libcurl" for product "Libcurl"				7.16.3 Search vendor "Libcurl" for product "Libcurl" and version "7.16.3"		-		Affected