[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <Pine.GSO.4.51.0908311546410.21074@faron.mitre.org>
Date: Mon, 31 Aug 2009 15:51:25 -0400 (EDT)
From: "Steven M. Christey" <coley@...us.mitre.org>
To: oss-security@...ts.openwall.com
cc: Steffen_Ullrich@...ua.de, "Steven M. Christey" <coley@...us.mitre.org>
Subject: Re: CVE request: perl-IO-Socket-SSL certificate
hostname compare bug
Steffen said:
>it would probably be nice to add a note to the CVE that apps/modules
>should start to implement proper certificate checking and that it got
>easier with newer IO::Socket::SSL versions.
There isn't really a place in CVE to do this. The description is
primarily to describe the problem in a way that allows us to distinguish
this issue from other issues. I've included your post as a reference,
however.
- Steve
======================================================
Name: CVE-2009-3024
Status: Candidate
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3024
Reference: MLIST:[oss-security] 20090828 CVE request: perl-IO-Socket-SSL certificate hostname compare bug
Reference: URL:http://www.openwall.com/lists/oss-security/2009/08/28/1
Reference: MLIST:[oss-security] 20090829 Re: CVE request: perl-IO-Socket-SSL certificate hostname compare bug
Reference: URL:http://www.openwall.com/lists/oss-security/2009/08/29/1
Reference: MLIST:[oss-security] 20090831 Re: Re: CVE request: perl-IO-Socket-SSL certificate hostname compare bug
Reference: URL:http://www.openwall.com/lists/oss-security/2009/08/31/4
Reference: CONFIRM:http://cpansearch.perl.org/src/SULLR/IO-Socket-SSL-1.30/Changes
The verify_hostname_of_cert function in the certificate checking
feature in IO-Socket-SSL (IO::Socket::SSL) 1.14 through 1.25 only
matches the prefix of a hostname when no wildcard is used, which
allows remote attackers to bypass the hostname check for a
certificate.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
