CVE-2009-2700
Summary
| CVE | CVE-2009-2700 |
|---|
| State | PUBLIC |
|---|
| Assigner | [email protected] |
|---|
| Source Priority | CVE Program / NVD first with legacy fallback |
|---|
| Published | 2009-09-02 17:30:00 UTC |
|---|
| Updated | 2021-06-16 12:43:00 UTC |
|---|
| Description | src/network/ssl/qsslcertificate.cpp in Nokia Trolltech Qt 4.x does not properly handle a '\0' character in a domain name in the Subject Alternative Name field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408. |
|---|
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|
| Application |
Digia |
Qt |
4.0.0 |
All |
All |
All |
| Application |
Digia |
Qt |
4.0.1 |
All |
All |
All |
| Application |
Digia |
Qt |
4.1.0 |
All |
All |
All |
| Application |
Digia |
Qt |
4.1.1 |
All |
All |
All |
| Application |
Digia |
Qt |
4.1.2 |
All |
All |
All |
| Application |
Digia |
Qt |
4.1.3 |
All |
All |
All |
| Application |
Digia |
Qt |
4.1.4 |
All |
All |
All |
| Application |
Digia |
Qt |
4.1.5 |
All |
All |
All |
| Application |
Digia |
Qt |
4.2.0 |
All |
All |
All |
| Application |
Digia |
Qt |
4.2.1 |
All |
All |
All |
| Application |
Digia |
Qt |
4.2.3 |
All |
All |
All |
| Application |
Digia |
Qt |
4.3.0 |
All |
All |
All |
| Application |
Digia |
Qt |
4.3.1 |
All |
All |
All |
| Application |
Digia |
Qt |
4.3.2 |
All |
All |
All |
| Application |
Digia |
Qt |
4.3.3 |
All |
All |
All |
| Application |
Digia |
Qt |
4.3.4 |
All |
All |
All |
| Application |
Digia |
Qt |
4.3.5 |
All |
All |
All |
| Application |
Digia |
Qt |
4.4.0 |
All |
All |
All |
| Application |
Digia |
Qt |
4.4.1 |
All |
All |
All |
| Application |
Digia |
Qt |
4.4.2 |
All |
All |
All |
| Application |
Digia |
Qt |
4.4.3 |
All |
All |
All |
| Application |
Digia |
Qt |
4.5.0 |
All |
All |
All |
| Application |
Digia |
Qt |
4.5.1 |
All |
All |
All |
| Application |
Digia |
Qt |
4.5.2 |
All |
All |
All |
| Application |
Digia |
Qt |
4.5.3 |
All |
All |
All |
| Application |
Digia |
Qt |
4.6.0 |
All |
All |
All |
| Application |
Digia |
Qt |
4.6.0 |
rc1 |
All |
All |
| Application |
Digia |
Qt |
4.6.1 |
All |
All |
All |
| Application |
Digia |
Qt |
4.6.2 |
All |
All |
All |
| Application |
Digia |
Qt |
4.6.3 |
All |
All |
All |
| Application |
Digia |
Qt |
4.6.4 |
All |
All |
All |
| Application |
Digia |
Qt |
4.7.0 |
All |
All |
All |
| Application |
Digia |
Qt |
4.7.1 |
All |
All |
All |
| Application |
Digia |
Qt |
4.7.2 |
All |
All |
All |
| Application |
Digia |
Qt |
4.7.3 |
All |
All |
All |
| Application |
Digia |
Qt |
4.7.4 |
All |
All |
All |
| Application |
Digia |
Qt |
4.7.5 |
All |
All |
All |
| Application |
Digia |
Qt |
4.8.0 |
All |
All |
All |
| Application |
Digia |
Qt |
4.8.1 |
All |
All |
All |
| Application |
Digia |
Qt |
4.8.2 |
All |
All |
All |
| Application |
Digia |
Qt |
4.8.3 |
All |
All |
All |
| Application |
Digia |
Qt |
4.8.4 |
All |
All |
All |
| Application |
Digia |
Qt |
4.0.0 |
All |
All |
All |
| Application |
Digia |
Qt |
4.0.1 |
All |
All |
All |
| Application |
Digia |
Qt |
4.1.0 |
All |
All |
All |
| Application |
Digia |
Qt |
4.1.1 |
All |
All |
All |
| Application |
Digia |
Qt |
4.1.2 |
All |
All |
All |
| Application |
Digia |
Qt |
4.1.3 |
All |
All |
All |
| Application |
Digia |
Qt |
4.1.4 |
All |
All |
All |
| Application |
Digia |
Qt |
4.1.5 |
All |
All |
All |
| Application |
Digia |
Qt |
4.2.0 |
All |
All |
All |
| Application |
Digia |
Qt |
4.2.1 |
All |
All |
All |
| Application |
Digia |
Qt |
4.2.3 |
All |
All |
All |
| Application |
Digia |
Qt |
4.3.0 |
All |
All |
All |
| Application |
Digia |
Qt |
4.3.1 |
All |
All |
All |
| Application |
Digia |
Qt |
4.3.2 |
All |
All |
All |
| Application |
Digia |
Qt |
4.3.3 |
All |
All |
All |
| Application |
Digia |
Qt |
4.3.4 |
All |
All |
All |
| Application |
Digia |
Qt |
4.3.5 |
All |
All |
All |
| Application |
Digia |
Qt |
4.4.0 |
All |
All |
All |
| Application |
Digia |
Qt |
4.4.1 |
All |
All |
All |
| Application |
Digia |
Qt |
4.4.2 |
All |
All |
All |
| Application |
Digia |
Qt |
4.4.3 |
All |
All |
All |
| Application |
Digia |
Qt |
4.5.0 |
All |
All |
All |
| Application |
Digia |
Qt |
4.5.1 |
All |
All |
All |
| Application |
Digia |
Qt |
4.5.2 |
All |
All |
All |
| Application |
Digia |
Qt |
4.5.3 |
All |
All |
All |
| Application |
Digia |
Qt |
4.6.0 |
All |
All |
All |
| Application |
Digia |
Qt |
4.6.0 |
rc1 |
All |
All |
| Application |
Digia |
Qt |
4.6.1 |
All |
All |
All |
| Application |
Digia |
Qt |
4.6.2 |
All |
All |
All |
| Application |
Digia |
Qt |
4.6.3 |
All |
All |
All |
| Application |
Digia |
Qt |
4.6.4 |
All |
All |
All |
| Application |
Digia |
Qt |
4.7.0 |
All |
All |
All |
| Application |
Digia |
Qt |
4.7.1 |
All |
All |
All |
| Application |
Digia |
Qt |
4.7.2 |
All |
All |
All |
| Application |
Digia |
Qt |
4.7.3 |
All |
All |
All |
| Application |
Digia |
Qt |
4.7.4 |
All |
All |
All |
| Application |
Digia |
Qt |
4.7.5 |
All |
All |
All |
| Application |
Digia |
Qt |
4.8.0 |
All |
All |
All |
| Application |
Digia |
Qt |
4.8.1 |
All |
All |
All |
| Application |
Digia |
Qt |
4.8.2 |
All |
All |
All |
| Application |
Digia |
Qt |
4.8.3 |
All |
All |
All |
| Application |
Digia |
Qt |
4.8.4 |
All |
All |
All |
| Application |
Qt |
Qt |
4.0.0 |
All |
All |
All |
| Application |
Qt |
Qt |
4.0.1 |
All |
All |
All |
| Application |
Qt |
Qt |
4.1.0 |
All |
All |
All |
| Application |
Qt |
Qt |
4.1.1 |
All |
All |
All |
| Application |
Qt |
Qt |
4.1.2 |
All |
All |
All |
| Application |
Qt |
Qt |
4.1.3 |
All |
All |
All |
| Application |
Qt |
Qt |
4.1.4 |
All |
All |
All |
| Application |
Qt |
Qt |
4.1.5 |
All |
All |
All |
| Application |
Qt |
Qt |
4.2.0 |
All |
All |
All |
| Application |
Qt |
Qt |
4.2.1 |
All |
All |
All |
| Application |
Qt |
Qt |
4.2.3 |
All |
All |
All |
| Application |
Qt |
Qt |
4.3.0 |
All |
All |
All |
| Application |
Qt |
Qt |
4.3.1 |
All |
All |
All |
| Application |
Qt |
Qt |
4.3.2 |
All |
All |
All |
| Application |
Qt |
Qt |
4.3.3 |
All |
All |
All |
| Application |
Qt |
Qt |
4.3.4 |
All |
All |
All |
| Application |
Qt |
Qt |
4.3.5 |
All |
All |
All |
| Application |
Qt |
Qt |
4.4.0 |
All |
All |
All |
| Application |
Qt |
Qt |
4.4.1 |
All |
All |
All |
| Application |
Qt |
Qt |
4.4.2 |
All |
All |
All |
| Application |
Qt |
Qt |
4.4.3 |
All |
All |
All |
| Application |
Qt |
Qt |
4.5.0 |
All |
All |
All |
| Application |
Qt |
Qt |
4.5.1 |
All |
All |
All |
| Application |
Qt |
Qt |
4.5.2 |
All |
All |
All |
| Application |
Qt |
Qt |
4.5.3 |
All |
All |
All |
| Application |
Qt |
Qt |
4.6.0 |
All |
All |
All |
| Application |
Qt |
Qt |
4.6.0 |
rc1 |
All |
All |
| Application |
Qt |
Qt |
4.6.1 |
All |
All |
All |
| Application |
Qt |
Qt |
4.6.2 |
All |
All |
All |
| Application |
Qt |
Qt |
4.6.3 |
All |
All |
All |
| Application |
Qt |
Qt |
4.6.4 |
All |
All |
All |
| Application |
Qt |
Qt |
4.7.0 |
All |
All |
All |
| Application |
Qt |
Qt |
4.7.1 |
All |
All |
All |
| Application |
Qt |
Qt |
4.7.2 |
All |
All |
All |
| Application |
Qt |
Qt |
4.7.3 |
All |
All |
All |
| Application |
Qt |
Qt |
4.7.4 |
All |
All |
All |
| Application |
Qt |
Qt |
4.7.5 |
All |
All |
All |
| Application |
Qt |
Qt |
4.8.0 |
All |
All |
All |
| Application |
Qt |
Qt |
4.8.1 |
All |
All |
All |
| Application |
Qt |
Qt |
4.8.2 |
All |
All |
All |
| Application |
Qt |
Qt |
4.8.3 |
All |
All |
All |
| Application |
Qt |
Qt |
4.8.4 |
All |
All |
All |
References
| Reference | Source | Link | Tags |
|---|
| Ubuntu update for qt - Secunia Advisories - Vulnerability Information - Secunia.com |
SECUNIA |
secunia.com |
Vendor Advisory |
| Webmail : Solution de messagerie professionnelle - OVHcloud- OVH |
VUPEN |
www.vupen.com |
Vendor Advisory |
| Qt NULL Character CA SSL Certificate Validation Security Bypass Vulnerability |
BID |
www.securityfocus.com |
|
| Support / Security / Advisories / / MDVSA-2009:225 | Mandriva |
MANDRIVA |
www.mandriva.com |
|
| USN-829-1: Qt vulnerability | Ubuntu |
UBUNTU |
www.ubuntu.com |
|
| Qt NULL Character Certificate Spoofing Vulnerability - Secunia Advisories - Vulnerability Information - Secunia.com |
SECUNIA |
secunia.com |
Vendor Advisory |
| Commit in qt in Qt - Qt by Nokia |
CONFIRM |
qt.gitorious.org |
|
| CVE Program record |
CVE.ORG |
www.cve.org |
canonical |
| NVD vulnerability detail |
NVD |
nvd.nist.gov |
canonical, analysis |
Vendor Comments And Credit
| Organization | Published | Contributor | Statement |
|---|
| Red Hat | 2009-09-03 | Tomas Hoger | Not vulnerable. This issue did not affect the versions of qt and qt4 as shipped with Red Hat Enterprise Linux 3, 4, or 5. Affected code was introduced upstream in version 4.3. |
There are currently no legacy QID mappings associated with this CVE.
