CVE-2009-2700
Summary
| CVE | CVE-2009-2700 |
|---|---|
| State | PUBLISHED |
| Assigner | mitre |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2009-09-02 17:30:00 UTC |
| Updated | 2026-04-23 00:35:47 UTC |
| Description | src/network/ssl/qsslcertificate.cpp in Nokia Trolltech Qt 4.x does not properly handle a '\0' character in a domain name in the Subject Alternative Name field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408. |
Risk And Classification
CVSS v2.0 Breakdown
Access Vector
NetworkAccess Complexity
MediumAuthentication
NoneConfidentiality
NoneIntegrity
PartialAvailability
NoneAV:N/AC:M/Au:N/C:N/I:P/A:N
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Qt | Qt | 4.0.0 | All | All | All |
| Application | Qt | Qt | 4.0.1 | All | All | All |
| Application | Qt | Qt | 4.1.0 | All | All | All |
| Application | Qt | Qt | 4.1.1 | All | All | All |
| Application | Qt | Qt | 4.1.2 | All | All | All |
| Application | Qt | Qt | 4.1.3 | All | All | All |
| Application | Qt | Qt | 4.1.4 | All | All | All |
| Application | Qt | Qt | 4.1.5 | All | All | All |
| Application | Qt | Qt | 4.2.0 | All | All | All |
| Application | Qt | Qt | 4.2.1 | All | All | All |
| Application | Qt | Qt | 4.2.3 | All | All | All |
| Application | Qt | Qt | 4.3.0 | All | All | All |
| Application | Qt | Qt | 4.3.1 | All | All | All |
| Application | Qt | Qt | 4.3.2 | All | All | All |
| Application | Qt | Qt | 4.3.3 | All | All | All |
| Application | Qt | Qt | 4.3.4 | All | All | All |
| Application | Qt | Qt | 4.3.5 | All | All | All |
| Application | Qt | Qt | 4.4.0 | All | All | All |
| Application | Qt | Qt | 4.4.1 | All | All | All |
| Application | Qt | Qt | 4.4.2 | All | All | All |
| Application | Qt | Qt | 4.4.3 | All | All | All |
| Application | Qt | Qt | 4.5.0 | All | All | All |
| Application | Qt | Qt | 4.5.1 | All | All | All |
| Application | Qt | Qt | 4.5.2 | All | All | All |
| Application | Qt | Qt | 4.5.3 | All | All | All |
| Application | Qt | Qt | 4.6.0 | All | All | All |
| Application | Qt | Qt | 4.6.0 | rc1 | All | All |
| Application | Qt | Qt | 4.6.1 | All | All | All |
| Application | Qt | Qt | 4.6.2 | All | All | All |
| Application | Qt | Qt | 4.6.3 | All | All | All |
| Application | Qt | Qt | 4.6.4 | All | All | All |
| Application | Qt | Qt | 4.7.0 | All | All | All |
| Application | Qt | Qt | 4.7.1 | All | All | All |
| Application | Qt | Qt | 4.7.2 | All | All | All |
| Application | Qt | Qt | 4.7.3 | All | All | All |
| Application | Qt | Qt | 4.7.4 | All | All | All |
| Application | Qt | Qt | 4.7.5 | All | All | All |
| Application | Qt | Qt | 4.8.0 | All | All | All |
| Application | Qt | Qt | 4.8.1 | All | All | All |
| Application | Qt | Qt | 4.8.2 | All | All | All |
| Application | Qt | Qt | 4.8.3 | All | All | All |
| Application | Qt | Qt | 4.8.4 | All | All | All |
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Qt NULL Character CA SSL Certificate Validation Security Bypass Vulnerability | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | |
| USN-829-1: Qt vulnerability | Ubuntu | af854a3a-2127-422b-91ae-364da2661108 | www.ubuntu.com | |
| Support / Security / Advisories / / MDVSA-2009:225 | Mandriva | af854a3a-2127-422b-91ae-364da2661108 | www.mandriva.com | |
| Commit in qt in Qt - Qt by Nokia | af854a3a-2127-422b-91ae-364da2661108 | qt.gitorious.org | |
| Webmail : Solution de messagerie professionnelle - OVHcloud- OVH | af854a3a-2127-422b-91ae-364da2661108 | www.vupen.com | Vendor Advisory |
| Ubuntu update for qt - Secunia Advisories - Vulnerability Information - Secunia.com | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Vendor Advisory |
| Qt NULL Character Certificate Spoofing Vulnerability - Secunia Advisories - Vulnerability Information - Secunia.com | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Vendor Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
| Organization | Published | Contributor | Statement |
|---|---|---|---|
| Red Hat | 2009-09-03 | Tomas Hoger | Not vulnerable. This issue did not affect the versions of qt and qt4 as shipped with Red Hat Enterprise Linux 3, 4, or 5. Affected code was introduced upstream in version 4.3. |
There are currently no legacy QID mappings associated with this CVE.