National Cyber Awareness System

Vulnerability Summary for CVE-2009-3024

Overview

The verify_hostname_of_cert function in the certificate checking feature in IO-Socket-SSL (IO::Socket::SSL) 1.14 through 1.25 only matches the prefix of a hostname when no wildcard is used, which allows remote attackers to bypass the hostname check for a certificate.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: VUPEN

Name: ADV-2011-0118

Hyperlink:http://www.vupen.com/english/advisories/2011/0118

External Source: MLIST

Name: [oss-security] 20090831 Re: Re: CVE request: perl-IO-Socket-SSL certificate hostname compare bug

Hyperlink:http://www.openwall.com/lists/oss-security/2009/08/31/4

External Source: MLIST

Name: [oss-security] 20090829 Re: CVE request: perl-IO-Socket-SSL certificate hostname compare bug

Hyperlink:http://www.openwall.com/lists/oss-security/2009/08/29/1

External Source: MLIST

Name: [oss-security] 20090828 CVE request: perl-IO-Socket-SSL certificate hostname compare bug

Hyperlink:http://www.openwall.com/lists/oss-security/2009/08/28/1

External Source: GENTOO

Name: GLSA-201101-06

Hyperlink:http://www.gentoo.org/security/en/glsa/glsa-201101-06.xml

External Source: SECUNIA

Name: 42893

Hyperlink:http://secunia.com/advisories/42893

External Source: SUSE

Name: SUSE-SR:2009:015

Hyperlink:http://lists.opensuse.org/opensuse-security-announce/2009-09/msg00001.html

External Source: CONFIRM

Name: http://cpansearch.perl.org/src/SULLR/IO-Socket-SSL-1.30/Changes

Hyperlink:http://cpansearch.perl.org/src/SULLR/IO-Socket-SSL-1.30/Changes