CVE-2009-2409

Summary

CVECVE-2009-2409
StatePUBLIC
Assigner[email protected]
Source PriorityCVE Program / NVD first with legacy fallback
Published2009-07-30 19:30:00 UTC
Updated2023-11-07 02:04:00 UTC
DescriptionThe Network Security Services (NSS) library before 3.12.3, as used in Firefox; GnuTLS before 2.6.4 and 2.7.4; OpenSSL 0.9.8 through 0.9.8k; and other products support MD2 with X.509 certificates, which might allow remote attackers to spoof certificates by using MD2 design flaws to generate a hash collision in less than brute-force time. NOTE: the scope of this issue is currently limited because the amount of computation required is still large.

Risk And Classification

Problem Types: CWE-310

NVD Known Affected Configurations (CPE 2.3)

TypeVendorProductVersionUpdateEditionLanguage
Application Gnu Gnutls 1.0.16 All All All
Application Gnu Gnutls 1.0.17 All All All
Application Gnu Gnutls 1.0.18 All All All
Application Gnu Gnutls 1.0.19 All All All
Application Gnu Gnutls 1.0.20 All All All
Application Gnu Gnutls 1.0.21 All All All
Application Gnu Gnutls 1.0.22 All All All
Application Gnu Gnutls 1.0.23 All All All
Application Gnu Gnutls 1.0.24 All All All
Application Gnu Gnutls 1.0.25 All All All
Application Gnu Gnutls 1.1.13 All All All
Application Gnu Gnutls 1.1.14 All All All
Application Gnu Gnutls 1.1.15 All All All
Application Gnu Gnutls 1.1.16 All All All
Application Gnu Gnutls 1.1.17 All All All
Application Gnu Gnutls 1.1.18 All All All
Application Gnu Gnutls 1.1.19 All All All
Application Gnu Gnutls 1.1.20 All All All
Application Gnu Gnutls 1.1.21 All All All
Application Gnu Gnutls 1.1.22 All All All
Application Gnu Gnutls 1.1.23 All All All
Application Gnu Gnutls 1.2.0 All All All
Application Gnu Gnutls 1.2.1 All All All
Application Gnu Gnutls 1.2.10 All All All
Application Gnu Gnutls 1.2.11 All All All
Application Gnu Gnutls 1.2.2 All All All
Application Gnu Gnutls 1.2.3 All All All
Application Gnu Gnutls 1.2.4 All All All
Application Gnu Gnutls 1.2.5 All All All
Application Gnu Gnutls 1.2.6 All All All
Application Gnu Gnutls 1.2.7 All All All
Application Gnu Gnutls 1.2.8 All All All
Application Gnu Gnutls 1.2.8.1a1 All All All
Application Gnu Gnutls 1.2.9 All All All
Application Gnu Gnutls 1.3.0 All All All
Application Gnu Gnutls 1.3.1 All All All
Application Gnu Gnutls 1.3.2 All All All
Application Gnu Gnutls 1.3.3 All All All
Application Gnu Gnutls 1.3.4 All All All
Application Gnu Gnutls 1.3.5 All All All
Application Gnu Gnutls 1.4.0 All All All
Application Gnu Gnutls 1.4.1 All All All
Application Gnu Gnutls 1.4.2 All All All
Application Gnu Gnutls 1.4.3 All All All
Application Gnu Gnutls 1.4.4 All All All
Application Gnu Gnutls 1.4.5 All All All
Application Gnu Gnutls 1.5.0 All All All
Application Gnu Gnutls 1.5.1 All All All
Application Gnu Gnutls 1.5.2 All All All
Application Gnu Gnutls 1.5.3 All All All
Application Gnu Gnutls 1.5.4 All All All
Application Gnu Gnutls 1.5.5 All All All
Application Gnu Gnutls 1.6.0 All All All
Application Gnu Gnutls 1.6.1 All All All
Application Gnu Gnutls 1.6.2 All All All
Application Gnu Gnutls 1.6.3 All All All
Application Gnu Gnutls 1.7.0 All All All
Application Gnu Gnutls 1.7.1 All All All
Application Gnu Gnutls 1.7.10 All All All
Application Gnu Gnutls 1.7.11 All All All
Application Gnu Gnutls 1.7.12 All All All
Application Gnu Gnutls 1.7.13 All All All
Application Gnu Gnutls 1.7.14 All All All
Application Gnu Gnutls 1.7.15 All All All
Application Gnu Gnutls 1.7.16 All All All
Application Gnu Gnutls 1.7.17 All All All
Application Gnu Gnutls 1.7.18 All All All
Application Gnu Gnutls 1.7.19 All All All
Application Gnu Gnutls 1.7.2 All All All
Application Gnu Gnutls 1.7.3 All All All
Application Gnu Gnutls 1.7.4 All All All
Application Gnu Gnutls 1.7.5 All All All
Application Gnu Gnutls 1.7.6 All All All
Application Gnu Gnutls 1.7.7 All All All
Application Gnu Gnutls 1.7.8 All All All
Application Gnu Gnutls 1.7.9 All All All
Application Gnu Gnutls 2.0.0 All All All
Application Gnu Gnutls 2.0.1 All All All
Application Gnu Gnutls 2.0.2 All All All
Application Gnu Gnutls 2.0.3 All All All
Application Gnu Gnutls 2.0.4 All All All
Application Gnu Gnutls 2.1.0 All All All
Application Gnu Gnutls 2.1.1 All All All
Application Gnu Gnutls 2.1.2 All All All
Application Gnu Gnutls 2.1.3 All All All
Application Gnu Gnutls 2.1.4 All All All
Application Gnu Gnutls 2.1.5 All All All
Application Gnu Gnutls 2.1.6 All All All
Application Gnu Gnutls 2.1.7 All All All
Application Gnu Gnutls 2.1.8 All All All
Application Gnu Gnutls 2.2.0 All All All
Application Gnu Gnutls 2.2.1 All All All
Application Gnu Gnutls 2.2.2 All All All
Application Gnu Gnutls 2.2.3 All All All
Application Gnu Gnutls 2.2.4 All All All
Application Gnu Gnutls 2.2.5 All All All
Application Gnu Gnutls 2.3.0 All All All
Application Gnu Gnutls 2.3.1 All All All
Application Gnu Gnutls 2.3.10 All All All
Application Gnu Gnutls 2.3.11 All All All
Application Gnu Gnutls 2.3.2 All All All
Application Gnu Gnutls 2.3.3 All All All
Application Gnu Gnutls 2.3.4 All All All
Application Gnu Gnutls 2.3.5 All All All
Application Gnu Gnutls 2.3.6 All All All
Application Gnu Gnutls 2.3.7 All All All
Application Gnu Gnutls 2.3.8 All All All
Application Gnu Gnutls 2.3.9 All All All
Application Gnu Gnutls 2.4.0 All All All
Application Gnu Gnutls 2.4.1 All All All
Application Gnu Gnutls 2.4.2 All All All
Application Gnu Gnutls 2.5.0 All All All
Application Gnu Gnutls 2.6.0 All All All
Application Gnu Gnutls 2.6.1 All All All
Application Gnu Gnutls 2.6.2 All All All
Application Gnu Gnutls 2.7.4 All All All
Application Gnu Gnutls 1.0.16 All All All
Application Gnu Gnutls 1.0.17 All All All
Application Gnu Gnutls 1.0.18 All All All
Application Gnu Gnutls 1.0.19 All All All
Application Gnu Gnutls 1.0.20 All All All
Application Gnu Gnutls 1.0.21 All All All
Application Gnu Gnutls 1.0.22 All All All
Application Gnu Gnutls 1.0.23 All All All
Application Gnu Gnutls 1.0.24 All All All
Application Gnu Gnutls 1.0.25 All All All
Application Gnu Gnutls 1.1.13 All All All
Application Gnu Gnutls 1.1.14 All All All
Application Gnu Gnutls 1.1.15 All All All
Application Gnu Gnutls 1.1.16 All All All
Application Gnu Gnutls 1.1.17 All All All
Application Gnu Gnutls 1.1.18 All All All
Application Gnu Gnutls 1.1.19 All All All
Application Gnu Gnutls 1.1.20 All All All
Application Gnu Gnutls 1.1.21 All All All
Application Gnu Gnutls 1.1.22 All All All
Application Gnu Gnutls 1.1.23 All All All
Application Gnu Gnutls 1.2.0 All All All
Application Gnu Gnutls 1.2.1 All All All
Application Gnu Gnutls 1.2.10 All All All
Application Gnu Gnutls 1.2.11 All All All
Application Gnu Gnutls 1.2.2 All All All
Application Gnu Gnutls 1.2.3 All All All
Application Gnu Gnutls 1.2.4 All All All
Application Gnu Gnutls 1.2.5 All All All
Application Gnu Gnutls 1.2.6 All All All
Application Gnu Gnutls 1.2.7 All All All
Application Gnu Gnutls 1.2.8 All All All
Application Gnu Gnutls 1.2.8.1a1 All All All
Application Gnu Gnutls 1.2.9 All All All
Application Gnu Gnutls 1.3.0 All All All
Application Gnu Gnutls 1.3.1 All All All
Application Gnu Gnutls 1.3.2 All All All
Application Gnu Gnutls 1.3.3 All All All
Application Gnu Gnutls 1.3.4 All All All
Application Gnu Gnutls 1.3.5 All All All
Application Gnu Gnutls 1.4.0 All All All
Application Gnu Gnutls 1.4.1 All All All
Application Gnu Gnutls 1.4.2 All All All
Application Gnu Gnutls 1.4.3 All All All
Application Gnu Gnutls 1.4.4 All All All
Application Gnu Gnutls 1.4.5 All All All
Application Gnu Gnutls 1.5.0 All All All
Application Gnu Gnutls 1.5.1 All All All
Application Gnu Gnutls 1.5.2 All All All
Application Gnu Gnutls 1.5.3 All All All
Application Gnu Gnutls 1.5.4 All All All
Application Gnu Gnutls 1.5.5 All All All
Application Gnu Gnutls 1.6.0 All All All
Application Gnu Gnutls 1.6.1 All All All
Application Gnu Gnutls 1.6.2 All All All
Application Gnu Gnutls 1.6.3 All All All
Application Gnu Gnutls 1.7.0 All All All
Application Gnu Gnutls 1.7.1 All All All
Application Gnu Gnutls 1.7.10 All All All
Application Gnu Gnutls 1.7.11 All All All
Application Gnu Gnutls 1.7.12 All All All
Application Gnu Gnutls 1.7.13 All All All
Application Gnu Gnutls 1.7.14 All All All
Application Gnu Gnutls 1.7.15 All All All
Application Gnu Gnutls 1.7.16 All All All
Application Gnu Gnutls 1.7.17 All All All
Application Gnu Gnutls 1.7.18 All All All
Application Gnu Gnutls 1.7.19 All All All
Application Gnu Gnutls 1.7.2 All All All
Application Gnu Gnutls 1.7.3 All All All
Application Gnu Gnutls 1.7.4 All All All
Application Gnu Gnutls 1.7.5 All All All
Application Gnu Gnutls 1.7.6 All All All
Application Gnu Gnutls 1.7.7 All All All
Application Gnu Gnutls 1.7.8 All All All
Application Gnu Gnutls 1.7.9 All All All
Application Gnu Gnutls 2.0.0 All All All
Application Gnu Gnutls 2.0.1 All All All
Application Gnu Gnutls 2.0.2 All All All
Application Gnu Gnutls 2.0.3 All All All
Application Gnu Gnutls 2.0.4 All All All
Application Gnu Gnutls 2.1.0 All All All
Application Gnu Gnutls 2.1.1 All All All
Application Gnu Gnutls 2.1.2 All All All
Application Gnu Gnutls 2.1.3 All All All
Application Gnu Gnutls 2.1.4 All All All
Application Gnu Gnutls 2.1.5 All All All
Application Gnu Gnutls 2.1.6 All All All
Application Gnu Gnutls 2.1.7 All All All
Application Gnu Gnutls 2.1.8 All All All
Application Gnu Gnutls 2.2.0 All All All
Application Gnu Gnutls 2.2.1 All All All
Application Gnu Gnutls 2.2.2 All All All
Application Gnu Gnutls 2.2.3 All All All
Application Gnu Gnutls 2.2.4 All All All
Application Gnu Gnutls 2.2.5 All All All
Application Gnu Gnutls 2.3.0 All All All
Application Gnu Gnutls 2.3.1 All All All
Application Gnu Gnutls 2.3.10 All All All
Application Gnu Gnutls 2.3.11 All All All
Application Gnu Gnutls 2.3.2 All All All
Application Gnu Gnutls 2.3.3 All All All
Application Gnu Gnutls 2.3.4 All All All
Application Gnu Gnutls 2.3.5 All All All
Application Gnu Gnutls 2.3.6 All All All
Application Gnu Gnutls 2.3.7 All All All
Application Gnu Gnutls 2.3.8 All All All
Application Gnu Gnutls 2.3.9 All All All
Application Gnu Gnutls 2.4.0 All All All
Application Gnu Gnutls 2.4.1 All All All
Application Gnu Gnutls 2.4.2 All All All
Application Gnu Gnutls 2.5.0 All All All
Application Gnu Gnutls 2.6.0 All All All
Application Gnu Gnutls 2.6.1 All All All
Application Gnu Gnutls 2.6.2 All All All
Application Gnu Gnutls 2.7.4 All All All
Application Gnu Gnutls All All All All
Application Mozilla Firefox All All All All
Application Mozilla Firefox All All All All
Application Mozilla Nss 3.0 All All All
Application Mozilla Nss 3.10 All All All
Application Mozilla Nss 3.11.2 All All All
Application Mozilla Nss 3.11.4 All All All
Application Mozilla Nss 3.11.7 All All All
Application Mozilla Nss 3.11.8 All All All
Application Mozilla Nss 3.12 All All All
Application Mozilla Nss 3.12.1 All All All
Application Mozilla Nss 3.2 All All All
Application Mozilla Nss 3.2.1 All All All
Application Mozilla Nss 3.3 All All All
Application Mozilla Nss 3.3.1 All All All
Application Mozilla Nss 3.3.2 All All All
Application Mozilla Nss 3.4 All All All
Application Mozilla Nss 3.4.1 All All All
Application Mozilla Nss 3.4.2 All All All
Application Mozilla Nss 3.4.3 All All All
Application Mozilla Nss 3.5 All All All
Application Mozilla Nss 3.6 All All All
Application Mozilla Nss 3.6.1 All All All
Application Mozilla Nss 3.7 All All All
Application Mozilla Nss 3.7.1 All All All
Application Mozilla Nss 3.7.2 All All All
Application Mozilla Nss 3.7.3 All All All
Application Mozilla Nss 3.7.5 All All All
Application Mozilla Nss 3.7.7 All All All
Application Mozilla Nss 3.8 All All All
Application Mozilla Nss 3.9 All All All
Application Mozilla Nss 3.9.5 All All All
Application Mozilla Nss 3.0 All All All
Application Mozilla Nss 3.10 All All All
Application Mozilla Nss 3.11.2 All All All
Application Mozilla Nss 3.11.4 All All All
Application Mozilla Nss 3.11.7 All All All
Application Mozilla Nss 3.11.8 All All All
Application Mozilla Nss 3.12 All All All
Application Mozilla Nss 3.12.1 All All All
Application Mozilla Nss 3.2 All All All
Application Mozilla Nss 3.2.1 All All All
Application Mozilla Nss 3.3 All All All
Application Mozilla Nss 3.3.1 All All All
Application Mozilla Nss 3.3.2 All All All
Application Mozilla Nss 3.4 All All All
Application Mozilla Nss 3.4.1 All All All
Application Mozilla Nss 3.4.2 All All All
Application Mozilla Nss 3.4.3 All All All
Application Mozilla Nss 3.5 All All All
Application Mozilla Nss 3.6 All All All
Application Mozilla Nss 3.6.1 All All All
Application Mozilla Nss 3.7 All All All
Application Mozilla Nss 3.7.1 All All All
Application Mozilla Nss 3.7.2 All All All
Application Mozilla Nss 3.7.3 All All All
Application Mozilla Nss 3.7.5 All All All
Application Mozilla Nss 3.7.7 All All All
Application Mozilla Nss 3.8 All All All
Application Mozilla Nss 3.9 All All All
Application Mozilla Nss 3.9.5 All All All
Application Mozilla Nss All All All All
Application Openssl Openssl 0.9.8 All All All
Application Openssl Openssl 0.9.8a All All All
Application Openssl Openssl 0.9.8b All All All
Application Openssl Openssl 0.9.8c All All All
Application Openssl Openssl 0.9.8d All All All
Application Openssl Openssl 0.9.8e All All All
Application Openssl Openssl 0.9.8f All All All
Application Openssl Openssl 0.9.8g All All All
Application Openssl Openssl 0.9.8h All All All
Application Openssl Openssl 0.9.8i All All All
Application Openssl Openssl 0.9.8j All All All
Application Openssl Openssl 0.9.8k All All All
Application Openssl Openssl 0.9.8 All All All
Application Openssl Openssl 0.9.8a All All All
Application Openssl Openssl 0.9.8b All All All
Application Openssl Openssl 0.9.8c All All All
Application Openssl Openssl 0.9.8d All All All
Application Openssl Openssl 0.9.8e All All All
Application Openssl Openssl 0.9.8f All All All
Application Openssl Openssl 0.9.8g All All All
Application Openssl Openssl 0.9.8h All All All
Application Openssl Openssl 0.9.8i All All All
Application Openssl Openssl 0.9.8j All All All
Application Openssl Openssl 0.9.8k All All All

References

ReferenceSourceLinkTags
Gentoo updates for sun-jre-bin, sun-jdk, blackdown-jre, blackdown-jdk, and emul-linux-x86-java - Secunia Advisories - Vulnerability Information - Secunia.com SECUNIA secunia.com Vendor Advisory
About Security Update 2009-006 / Mac OS X v10.6.2 CONFIRM support.apple.com
[syslog-ng-announce] syslog-ng Premium Edition 3.2.1a has been released MLIST lists.balabit.com
Red Hat update for seamonkey - Secunia Advisories - Vulnerability Information - Secunia.com SECUNIA secunia.com
Debian -- Security Information -- DSA-1874-1 nss DEBIAN www.debian.org
Repository / Oval Repository OVAL oval.cisecurity.org
USN-810-2: NSPR update | Ubuntu security notices UBUNTU usn.ubuntu.com
Ubuntu update for nss - Secunia Advisories - Vulnerability Information - Secunia.com SECUNIA secunia.com Vendor Advisory
SecurityTracker.com Archives - Network Security Services Library Supports Certificates With Weak MD2 Hash Signatures SECTRACK www.securitytracker.com
Repository / Oval Repository OVAL oval.cisecurity.org
Advisories | Mandriva MANDRIVA www.mandriva.com
Repository / Oval Repository OVAL oval.cisecurity.org
APPLE-SA-2009-11-09-1 Security Update 2009-006 / Mac OS X v10.6.2 APPLE lists.apple.com Vendor Advisory
Support / Security / Advisories / / MDVSA-2009:197 | Mandriva MANDRIVA www.mandriva.com
USN-810-1: NSS vulnerabilities | Ubuntu UBUNTU www.ubuntu.com
Red Hat Customer Portal REDHAT rhn.redhat.com
Gentoo Linux Documentation -- Sun JDK/JRE: Multiple vulnerabilites GENTOO security.gentoo.org
Gentoo Linux Documentation -- OpenSSL: Multiple vulnerabilities GENTOO security.gentoo.org
Ubuntu update for nspr - Secunia Advisories - Vulnerability Information - Secunia.com SECUNIA secunia.com Vendor Advisory
Webmail : Solution de messagerie professionnelle - OVHcloud- OVH VUPEN www.vupen.com Vendor Advisory
Java SE 6 Update 17 Release Notes. CONFIRM java.sun.com
Debian update for openssl - Secunia Advisories - Vulnerability Information - Secunia.com SECUNIA secunia.com Vendor Advisory
Debian update for nss - Secunia Advisories - Vulnerability Information - Secunia.com SECUNIA secunia.com Vendor Advisory
Support / Security / Advisories / / MDVSA-2009:258 | Mandriva MANDRIVA www.mandriva.com
Repository / Oval Repository OVAL oval.cisecurity.org
VMSA-2010-0019.3 CONFIRM www.vmware.com
JDK 5.0u22 Release Notes CONFIRM java.sun.com Patch
Debian -- Security Information -- DSA-1888-1 openssl, openssl097 DEBIAN www.debian.org
About Secunia Research | Flexera SECUNIA secunia.com Vendor Advisory
Bug 510197 – CVE-2009-2409 deprecate MD2 in SSL cert validation (Kaminsky) CONFIRM bugzilla.redhat.com
Webmail : Solution de messagerie professionnelle - OVHcloud- OVH VUPEN www.vupen.com Vendor Advisory
[syslog-ng-announce] syslog-ng Premium Edition 3.0.6a has been released MLIST lists.balabit.com
Support REDHAT www.redhat.com
Support REDHAT www.redhat.com
Webmail : Solution de messagerie professionnelle - OVHcloud- OVH VUPEN www.vupen.com Vendor Advisory
SecurityFocus BUGTRAQ www.securityfocus.com
Support / Security / Advisories / / MDVSA-2009:216 | Mandriva MANDRIVA www.mandriva.com
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis
© CVE.report 2026 |

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

CVE.report and Source URL Uptime Status status.cve.report