CVE-2009-0051 - ZXID 0.29 and earlier does not properly check the return value from the OpenSSL DSA_verify function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature, a similar vulnerability to CVE-2008-5077

Back Back to CVE browser

MEDIUM

ZXID 0.29 and earlier does not properly check the return value from the OpenSSL DSA_verify function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature, a similar vulnerability to CVE-2008-5077

Published Jan 7, 2009

5.0

MEDIUM

CVSS 2.0

EPSS 1.17%

Description

ZXID 0.29 and earlier does not properly check the return value from the OpenSSL DSA_verify function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature, a similar vulnerability to CVE-2008-5077.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-287

Improper Authentication

References (4)

http://www.ocert.org/advisories/ocert-2008-016.html
x_refsource_MISC
http://www.securityfocus.com/archive/1/499827/100/0/threaded
mailing-listx_refsource_BUGTRAQ
https://euvd.enisa.europa.eu/vulnerability/EUVD-2009-0060
Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/47837
vdb-entryx_refsource_XF

Link	Providers	Tags
http://www.ocert.org/advisories/ocert-2008-016.html		x_refsource_MISC
http://www.securityfocus.com/archive/1/499827/100/0/threaded		mailing-listx_refsource_BUGTRAQ
https://euvd.enisa.europa.eu/vulnerability/EUVD-2009-0060		Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/47837		vdb-entryx_refsource_XF