CVE-2009-3024

{"id": "CVE-2009-3024", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2009-08-31T20:30:01.093", "references": [{"url": "http://cpansearch.perl.org/src/SULLR/IO-Socket-SSL-1.30/Changes", "source": "cve@mitre.org"}, {"url": "http://lists.opensuse.org/opensuse-security-announce/2009-09/msg00001.html", "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/42893", "source": "cve@mitre.org"}, {"url": "http://www.gentoo.org/security/en/glsa/glsa-201101-06.xml", "source": "cve@mitre.org"}, {"url": "http://www.openwall.com/lists/oss-security/2009/08/28/1", "source": "cve@mitre.org"}, {"url": "http://www.openwall.com/lists/oss-security/2009/08/29/1", "source": "cve@mitre.org"}, {"url": "http://www.openwall.com/lists/oss-security/2009/08/31/4", "source": "cve@mitre.org"}, {"url": "http://www.vupen.com/english/advisories/2011/0118", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-310"}]}], "descriptions": [{"lang": "en", "value": "The verify_hostname_of_cert function in the certificate checking feature in IO-Socket-SSL (IO::Socket::SSL) 1.14 through 1.25 only matches the prefix of a hostname when no wildcard is used, which allows remote attackers to bypass the hostname check for a certificate."}, {"lang": "es", "value": "La funci\u00f3n verify_hostname_of_cert en la funcionalidad de verificaci\u00f3n de certificado en IO-Socket-SSL (IO::Socket::SSL) v1.14 a la v1.25 \u00fanicamente compara el prefijo de un hostname cuando no se usa un comod\u00edn, lo que permite a atacantes remotos evitar la validaci\u00f3n de un hostname para un certificado."}], "lastModified": "2011-01-20T06:35:32.120", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:io-socket-ssl:io-socket-ssl:1.14:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "80EEE704-744B-487E-89D0-C38F0F0F00D1"}, {"criteria": "cpe:2.3:a:io-socket-ssl:io-socket-ssl:1.15:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "50AF3CCC-A126-40C2-BDE8-A376F286A5FE"}, {"criteria": "cpe:2.3:a:io-socket-ssl:io-socket-ssl:1.16:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E7922D38-6AD7-4D81-AF30-623BB8234E69"}, {"criteria": "cpe:2.3:a:io-socket-ssl:io-socket-ssl:1.16_1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "760ED2EB-9255-49A4-AFE7-4DD960215BD8"}, {"criteria": "cpe:2.3:a:io-socket-ssl:io-socket-ssl:1.16_2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7131102E-BEDB-4D63-9005-0EB646CAA918"}, {"criteria": "cpe:2.3:a:io-socket-ssl:io-socket-ssl:1.16_3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "064EBF4B-37EF-4334-87B4-EC4407A4F621"}, {"criteria": "cpe:2.3:a:io-socket-ssl:io-socket-ssl:1.17:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "288417CD-C82F-48DE-9D9F-897E3A6EB833"}, {"criteria": "cpe:2.3:a:io-socket-ssl:io-socket-ssl:1.18:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2BEE69A2-16BF-4E7B-9985-BFDFA5354DB9"}, {"criteria": "cpe:2.3:a:io-socket-ssl:io-socket-ssl:1.19:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9AED6875-A544-4608-9277-E82C5977D9EB"}, {"criteria": "cpe:2.3:a:io-socket-ssl:io-socket-ssl:1.20:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "669BA841-F8D7-4E4D-B9B5-776248A7C9D9"}, {"criteria": "cpe:2.3:a:io-socket-ssl:io-socket-ssl:1.21:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7FA78DEB-D81F-4442-ABF1-37FD5226EC12"}, {"criteria": "cpe:2.3:a:io-socket-ssl:io-socket-ssl:1.22:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "58BAC664-C570-4F8F-9CAB-8DEF9A3D54CD"}, {"criteria": "cpe:2.3:a:io-socket-ssl:io-socket-ssl:1.23:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "82C2F301-5CD4-4729-BC62-16B60E0EC9BA"}, {"criteria": "cpe:2.3:a:io-socket-ssl:io-socket-ssl:1.24:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "75C353EA-2FCC-4B0C-A4E7-CD8E0AC89255"}, {"criteria": "cpe:2.3:a:io-socket-ssl:io-socket-ssl:1.25:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8E6CA710-EC56-46A1-9114-48E928DFFB6D"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}