Neon NULL Character CA SSL Certificate Validation Security Bypass Vulnerability

Bugtraq ID:	36079
Class:	Design Error
CVE:	CVE-2009-2474
Remote:	Yes
Local:	No
Published:	Aug 18 2009 12:00AM
Updated:	May 07 2015 05:11PM
Credit:	Joe Orton
Vulnerable:	Ubuntu Ubuntu Linux 9.04 sparc Ubuntu Ubuntu Linux 9.04 powerpc Ubuntu Ubuntu Linux 9.04 lpia Ubuntu Ubuntu Linux 9.04 i386 Ubuntu Ubuntu Linux 9.04 amd64 Ubuntu Ubuntu Linux 8.10 sparc Ubuntu Ubuntu Linux 8.10 powerpc Ubuntu Ubuntu Linux 8.10 lpia Ubuntu Ubuntu Linux 8.10 i386 Ubuntu Ubuntu Linux 8.10 amd64 Ubuntu Ubuntu Linux 8.04 LTS sparc Ubuntu Ubuntu Linux 8.04 LTS powerpc Ubuntu Ubuntu Linux 8.04 LTS lpia Ubuntu Ubuntu Linux 8.04 LTS i386 Ubuntu Ubuntu Linux 8.04 LTS amd64 Ubuntu Ubuntu Linux 6.06 LTS sparc Ubuntu Ubuntu Linux 6.06 LTS powerpc Ubuntu Ubuntu Linux 6.06 LTS i386 Ubuntu Ubuntu Linux 6.06 LTS amd64 TortoiseSVN TortoiseSVN 1.6 TortoiseSVN TortoiseSVN 1.4.5 TortoiseSVN TortoiseSVN 1.4.4 TortoiseSVN TortoiseSVN 1.4.3 TortoiseSVN TortoiseSVN 1.4.2 TortoiseSVN TortoiseSVN 1.4.1 TortoiseSVN TortoiseSVN 1.4 TortoiseSVN TortoiseSVN 1.3.5 TortoiseSVN TortoiseSVN 1.2.6 TortoiseSVN TortoiseSVN 1.1.7 TortoiseSVN TortioseSVN 1.6.4 TortoiseSVN TortioseSVN 1.5 RedHat Enterprise Linux WS 4 RedHat Enterprise Linux ES 4.8.z RedHat Enterprise Linux ES 4 RedHat Enterprise Linux Desktop Workstation 5 client RedHat Enterprise Linux Desktop version 4 Red Hat Enterprise Linux EUS 5.4.z server Red Hat Enterprise Linux Desktop 5 client Red Hat Enterprise Linux AS 4.8.z Red Hat Enterprise Linux AS 4 Red Hat Enterprise Linux 5 Server Pardus Linux 2009 0 Neon Neon 0.28.5 Neon Neon 0.28.3 Neon Neon 0.28.2 Neon Neon 0.28.1 Neon Neon 0.28 Neon Client Library 0.26.3 Neon Client Library 0.26.2 Neon Client Library 0.26.1 Neon Client Library 0.26 Neon Client Library 0.24.6 Neon Client Library 0.24.5 Neon Client Library 0.24.4 Neon Client Library 0.24.3 Neon Client Library 0.24.2 Neon Client Library 0.24.1 Neon Client Library 0.24 Neon Client Library 0.23.8 Neon Client Library 0.23.7 Neon Client Library 0.23.6 Neon Client Library 0.23.5 Neon Client Library 0.23.4 Neon Client Library 0.23.3 Neon Client Library 0.23.2 Neon Client Library 0.23.1 Neon Client Library 0.23 Neon Client Library 0.19.3 - Debian Linux 3.0 sparc - Debian Linux 3.0 s/390 - Debian Linux 3.0 ppc - Debian Linux 3.0 mipsel - Debian Linux 3.0 mips - Debian Linux 3.0 m68k - Debian Linux 3.0 ia-64 - Debian Linux 3.0 ia-32 - Debian Linux 3.0 hppa - Debian Linux 3.0 arm - Debian Linux 3.0 alpha - Debian Linux 3.0 Mandriva Linux Mandrake 2009.1 x86_64 Mandriva Linux Mandrake 2009.1 Mandriva Linux Mandrake 2009.0 x86_64 Mandriva Linux Mandrake 2009.0 Mandriva Linux Mandrake 2008.1 x86_64 Mandriva Linux Mandrake 2008.1 Mandriva Linux Mandrake 2008.0 x86_64 Mandriva Linux Mandrake 2008.0 MandrakeSoft Multi Network Firewall 2.0 MandrakeSoft Enterprise Server 5 x86_64 MandrakeSoft Enterprise Server 5 MandrakeSoft Corporate Server 4.0 x86_64 MandrakeSoft Corporate Server 3.0 x86_64 MandrakeSoft Corporate Server 3.0 MandrakeSoft Corporate Server 4.0 Avaya Voice Portal 5.0 SP2 Avaya Voice Portal 5.0 SP1 Avaya Voice Portal 5.0 Avaya Messaging Storage Server 3.1 Avaya Message Networking 3.1 Avaya Intuity AUDIX LX 2.0 SP2 Avaya Intuity AUDIX LX 2.0 SP1 Avaya Intuity AUDIX LX 2.0 Apple Mac OS X Server 10.6.4 Apple Mac OS X Server 10.6.3 Apple Mac OS X Server 10.6.2 Apple Mac OS X Server 10.6.1 Apple Mac OS X Server 10.6 Apple Mac OS X 10.6.4 Apple Mac OS X 10.6.3 Apple Mac OS X 10.6.2 Apple Mac OS X 10.6.1 Apple Mac OS X 10.6
Not Vulnerable:	TortoiseSVN TortoiseSVN 1.6.5 Neon Neon 0.28.6 Apple Mac OS X Server 10.6.5

Neon NULL Character CA SSL Certificate Validation Security Bypass Vulnerability

Neon is prone to a security-bypass vulnerability because it fails to properly validate the domain name in a signed CA certificate, allowing attackers to substitute malicious SSL certificates for trusted ones.

This issue affects Neon when compiled against OpenSSL.

Successfully exploiting this issue allows attackers to perform man-in-the-middle attacks or impersonate trusted servers, which will aid in further attacks.

Versions prior to Neon 0.28.6 are vulnerable. Additional applications that use the affected library may also be vulnerable.

Neon NULL Character CA SSL Certificate Validation Security Bypass Vulnerability

Attackers use man-in-the-middle attacks to exploit this issue.

Neon NULL Character CA SSL Certificate Validation Security Bypass Vulnerability

Solution:
Updates are available. Please see the references for details.


Ubuntu Ubuntu Linux 8.04 LTS powerpc

• Ubuntu libneon27-dbg_0.27.2-1ubuntu0.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/n/neon27/libneon27-dbg_0.27.2-1ubunt u0.1_powerpc.deb


• Ubuntu libneon27-dev_0.27.2-1ubuntu0.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/n/neon27/libneon27-dev_0.27.2-1ubunt u0.1_powerpc.deb


• Ubuntu libneon27-gnutls-dbg_0.27.2-1ubuntu0.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/n/neon27/libneon27-gnutls-dbg_0.27.2 -1ubuntu0.1_powerpc.deb


• Ubuntu libneon27-gnutls-dev_0.27.2-1ubuntu0.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/n/neon27/libneon27-gnutls-dev_0.27.2 -1ubuntu0.1_powerpc.deb


• Ubuntu libneon27-gnutls_0.27.2-1ubuntu0.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/n/neon27/libneon27-gnutls_0.27.2-1ub untu0.1_powerpc.deb


• Ubuntu libneon27_0.27.2-1ubuntu0.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/n/neon27/libneon27_0.27.2-1ubuntu0.1 _powerpc.deb

Ubuntu Ubuntu Linux 8.10 powerpc

• Ubuntu libneon27-dbg_0.28.2-2ubuntu0.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/n/neon27/libneon27-dbg_0.28.2-2ubunt u0.1_powerpc.deb


• Ubuntu libneon27-dev_0.28.2-2ubuntu0.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/n/neon27/libneon27-dev_0.28.2-2ubunt u0.1_powerpc.deb


• Ubuntu libneon27-gnutls-dbg_0.28.2-2ubuntu0.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/n/neon27/libneon27-gnutls-dbg_0.28.2 -2ubuntu0.1_powerpc.deb


• Ubuntu libneon27-gnutls-dev_0.28.2-2ubuntu0.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/n/neon27/libneon27-gnutls-dev_0.28.2 -2ubuntu0.1_powerpc.deb


• Ubuntu libneon27-gnutls_0.28.2-2ubuntu0.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/n/neon27/libneon27-gnutls_0.28.2-2ub untu0.1_powerpc.deb


• Ubuntu libneon27_0.28.2-2ubuntu0.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/n/neon27/libneon27_0.28.2-2ubuntu0.1 _powerpc.deb

Ubuntu Ubuntu Linux 8.04 LTS sparc

• Ubuntu libneon27-dbg_0.27.2-1ubuntu0.1_sparc.deb
  http://ports.ubuntu.com/pool/main/n/neon27/libneon27-dbg_0.27.2-1ubunt u0.1_sparc.deb


• Ubuntu libneon27-dev_0.27.2-1ubuntu0.1_sparc.deb
  http://ports.ubuntu.com/pool/main/n/neon27/libneon27-dev_0.27.2-1ubunt u0.1_sparc.deb


• Ubuntu libneon27-gnutls-dbg_0.27.2-1ubuntu0.1_sparc.deb
  http://ports.ubuntu.com/pool/main/n/neon27/libneon27-gnutls-dbg_0.27.2 -1ubuntu0.1_sparc.deb


• Ubuntu libneon27-gnutls-dev_0.27.2-1ubuntu0.1_sparc.deb
  http://ports.ubuntu.com/pool/main/n/neon27/libneon27-gnutls-dev_0.27.2 -1ubuntu0.1_sparc.deb


• Ubuntu libneon27-gnutls_0.27.2-1ubuntu0.1_sparc.deb
  http://ports.ubuntu.com/pool/main/n/neon27/libneon27-gnutls_0.27.2-1ub untu0.1_sparc.deb


• Ubuntu libneon27_0.27.2-1ubuntu0.1_sparc.deb
  http://ports.ubuntu.com/pool/main/n/neon27/libneon27_0.27.2-1ubuntu0.1 _sparc.deb

Apple Mac OS X Server 10.6

• Apple MacOSXServUpdCombo10.6.5.dmg
  For Mac OS X Server v10.6 - v10.6.3
  http://www.apple.com/support/downloads/

Ubuntu Ubuntu Linux 6.06 LTS sparc

• Ubuntu libneon25-dbg_0.25.5.dfsg-5ubuntu0.1_sparc.deb
  http://security.ubuntu.com/ubuntu/pool/main/n/neon/libneon25-dbg_0.25. 5.dfsg-5ubuntu0.1_sparc.deb


• Ubuntu libneon25-dev_0.25.5.dfsg-5ubuntu0.1_sparc.deb
  http://security.ubuntu.com/ubuntu/pool/main/n/neon/libneon25-dev_0.25. 5.dfsg-5ubuntu0.1_sparc.deb


• Ubuntu libneon25_0.25.5.dfsg-5ubuntu0.1_sparc.deb
  http://security.ubuntu.com/ubuntu/pool/main/n/neon/libneon25_0.25.5.df sg-5ubuntu0.1_sparc.deb

Mandriva Linux Mandrake 2008.0 x86_64

• Mandriva lib64neon0.24-0.24.7-19.1mdv2008.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64neon0.24-devel-0.24.7-19.1mdv2008.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64neon0.24-static-devel-0.24.7-19.1mdv2008.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64neon0.26-0.26.4-2.1mdv2008.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64neon0.26-devel-0.26.4-2.1mdv2008.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64neon0.26-static-devel-0.26.4-2.1mdv2008.0.x86_64.rpm
  http://www.mandriva.com/en/download/

Ubuntu Ubuntu Linux 8.04 LTS amd64

• Ubuntu libneon27-dbg_0.27.2-1ubuntu0.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/n/neon27/libneon27-dbg_0.2 7.2-1ubuntu0.1_amd64.deb


• Ubuntu libneon27-dev_0.27.2-1ubuntu0.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/n/neon27/libneon27-dev_0.2 7.2-1ubuntu0.1_amd64.deb


• Ubuntu libneon27-gnutls-dbg_0.27.2-1ubuntu0.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/n/neon27/libneon27-gnutls- dbg_0.27.2-1ubuntu0.1_amd64.deb


• Ubuntu libneon27-gnutls-dev_0.27.2-1ubuntu0.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/n/neon27/libneon27-gnutls- dev_0.27.2-1ubuntu0.1_amd64.deb


• Ubuntu libneon27-gnutls_0.27.2-1ubuntu0.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/n/neon27/libneon27-gnutls_ 0.27.2-1ubuntu0.1_amd64.deb


• Ubuntu libneon27_0.27.2-1ubuntu0.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/n/neon27/libneon27_0.27.2- 1ubuntu0.1_amd64.deb

Mandriva Linux Mandrake 2008.0

• Mandriva libneon0.24-0.24.7-19.1mdv2008.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libneon0.24-devel-0.24.7-19.1mdv2008.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libneon0.24-static-devel-0.24.7-19.1mdv2008.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libneon0.26-0.26.4-2.1mdv2008.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libneon0.26-devel-0.26.4-2.1mdv2008.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libneon0.26-static-devel-0.26.4-2.1mdv2008.0.i586.rpm
  http://www.mandriva.com/en/download/

Ubuntu Ubuntu Linux 9.04 sparc

• Ubuntu libneon25-dev_0.28.2-6.1ubuntu0.1_sparc.deb
  http://ports.ubuntu.com/pool/main/n/neon27/libneon25-dev_0.28.2-6.1ubu ntu0.1_sparc.deb


• Ubuntu libneon27-dbg_0.28.2-6.1ubuntu0.1_sparc.deb
  http://ports.ubuntu.com/pool/main/n/neon27/libneon27-dbg_0.28.2-6.1ubu ntu0.1_sparc.deb


• Ubuntu libneon27-dev_0.28.2-6.1ubuntu0.1_sparc.deb
  http://ports.ubuntu.com/pool/main/n/neon27/libneon27-dev_0.28.2-6.1ubu ntu0.1_sparc.deb


• Ubuntu libneon27-gnutls-dbg_0.28.2-6.1ubuntu0.1_sparc.deb
  http://ports.ubuntu.com/pool/main/n/neon27/libneon27-gnutls-dbg_0.28.2 -6.1ubuntu0.1_sparc.deb


• Ubuntu libneon27-gnutls-dev_0.28.2-6.1ubuntu0.1_sparc.deb
  http://ports.ubuntu.com/pool/main/n/neon27/libneon27-gnutls-dev_0.28.2 -6.1ubuntu0.1_sparc.deb


• Ubuntu libneon27-gnutls_0.28.2-6.1ubuntu0.1_sparc.deb
  http://ports.ubuntu.com/pool/main/n/neon27/libneon27-gnutls_0.28.2-6.1 ubuntu0.1_sparc.deb


• Ubuntu libneon27_0.28.2-6.1ubuntu0.1_sparc.deb
  http://ports.ubuntu.com/pool/main/n/neon27/libneon27_0.28.2-6.1ubuntu0 .1_sparc.deb

Ubuntu Ubuntu Linux 9.04 powerpc

• Ubuntu libneon25-dev_0.28.2-6.1ubuntu0.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/n/neon27/libneon25-dev_0.28.2-6.1ubu ntu0.1_powerpc.deb


• Ubuntu libneon27-dbg_0.28.2-6.1ubuntu0.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/n/neon27/libneon27-dbg_0.28.2-6.1ubu ntu0.1_powerpc.deb


• Ubuntu libneon27-dev_0.28.2-6.1ubuntu0.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/n/neon27/libneon27-dev_0.28.2-6.1ubu ntu0.1_powerpc.deb


• Ubuntu libneon27-gnutls-dbg_0.28.2-6.1ubuntu0.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/n/neon27/libneon27-gnutls-dbg_0.28.2 -6.1ubuntu0.1_powerpc.deb


• Ubuntu libneon27-gnutls-dev_0.28.2-6.1ubuntu0.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/n/neon27/libneon27-gnutls-dev_0.28.2 -6.1ubuntu0.1_powerpc.deb


• Ubuntu libneon27-gnutls_0.28.2-6.1ubuntu0.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/n/neon27/libneon27-gnutls_0.28.2-6.1 ubuntu0.1_powerpc.deb


• Ubuntu libneon27_0.28.2-6.1ubuntu0.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/n/neon27/libneon27_0.28.2-6.1ubuntu0 .1_powerpc.deb

Ubuntu Ubuntu Linux 9.04 i386

• Ubuntu libneon25-dev_0.28.2-6.1ubuntu0.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/n/neon27/libneon25-dev_0.2 8.2-6.1ubuntu0.1_i386.deb


• Ubuntu libneon27-dbg_0.28.2-6.1ubuntu0.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/n/neon27/libneon27-dbg_0.2 8.2-6.1ubuntu0.1_i386.deb


• Ubuntu libneon27-dev_0.28.2-6.1ubuntu0.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/n/neon27/libneon27-dev_0.2 8.2-6.1ubuntu0.1_i386.deb


• Ubuntu libneon27-gnutls-dbg_0.28.2-6.1ubuntu0.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/n/neon27/libneon27-gnutls- dbg_0.28.2-6.1ubuntu0.1_i386.deb


• Ubuntu libneon27-gnutls-dev_0.28.2-6.1ubuntu0.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/n/neon27/libneon27-gnutls- dev_0.28.2-6.1ubuntu0.1_i386.deb


• Ubuntu libneon27-gnutls_0.28.2-6.1ubuntu0.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/n/neon27/libneon27-gnutls_ 0.28.2-6.1ubuntu0.1_i386.deb


• Ubuntu libneon27_0.28.2-6.1ubuntu0.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/n/neon27/libneon27_0.28.2- 6.1ubuntu0.1_i386.deb

Ubuntu Ubuntu Linux 8.10 sparc

• Ubuntu libneon27-dbg_0.28.2-2ubuntu0.1_sparc.deb
  http://ports.ubuntu.com/pool/main/n/neon27/libneon27-dbg_0.28.2-2ubunt u0.1_sparc.deb


• Ubuntu libneon27-dev_0.28.2-2ubuntu0.1_sparc.deb
  http://ports.ubuntu.com/pool/main/n/neon27/libneon27-dev_0.28.2-2ubunt u0.1_sparc.deb


• Ubuntu libneon27-gnutls-dbg_0.28.2-2ubuntu0.1_sparc.deb
  http://ports.ubuntu.com/pool/main/n/neon27/libneon27-gnutls-dbg_0.28.2 -2ubuntu0.1_sparc.deb


• Ubuntu libneon27-gnutls-dev_0.28.2-2ubuntu0.1_sparc.deb
  http://ports.ubuntu.com/pool/main/n/neon27/libneon27-gnutls-dev_0.28.2 -2ubuntu0.1_sparc.deb


• Ubuntu libneon27-gnutls_0.28.2-2ubuntu0.1_sparc.deb
  http://ports.ubuntu.com/pool/main/n/neon27/libneon27-gnutls_0.28.2-2ub untu0.1_sparc.deb


• Ubuntu libneon27_0.28.2-2ubuntu0.1_sparc.deb
  http://ports.ubuntu.com/pool/main/n/neon27/libneon27_0.28.2-2ubuntu0.1 _sparc.deb

Ubuntu Ubuntu Linux 9.04 lpia

• Ubuntu libneon25-dev_0.28.2-6.1ubuntu0.1_lpia.deb
  http://ports.ubuntu.com/pool/main/n/neon27/libneon25-dev_0.28.2-6.1ubu ntu0.1_lpia.deb


• Ubuntu libneon27-dbg_0.28.2-6.1ubuntu0.1_lpia.deb
  http://ports.ubuntu.com/pool/main/n/neon27/libneon27-dbg_0.28.2-6.1ubu ntu0.1_lpia.deb


• Ubuntu libneon27-dev_0.28.2-6.1ubuntu0.1_lpia.deb
  http://ports.ubuntu.com/pool/main/n/neon27/libneon27-dev_0.28.2-6.1ubu ntu0.1_lpia.deb


• Ubuntu libneon27-gnutls-dbg_0.28.2-6.1ubuntu0.1_lpia.deb
  http://ports.ubuntu.com/pool/main/n/neon27/libneon27-gnutls-dbg_0.28.2 -6.1ubuntu0.1_lpia.deb


• Ubuntu libneon27-gnutls-dev_0.28.2-6.1ubuntu0.1_lpia.deb
  http://ports.ubuntu.com/pool/main/n/neon27/libneon27-gnutls-dev_0.28.2 -6.1ubuntu0.1_lpia.deb


• Ubuntu libneon27-gnutls_0.28.2-6.1ubuntu0.1_lpia.deb
  http://ports.ubuntu.com/pool/main/n/neon27/libneon27-gnutls_0.28.2-6.1 ubuntu0.1_lpia.deb


• Ubuntu libneon27_0.28.2-6.1ubuntu0.1_lpia.deb
  http://ports.ubuntu.com/pool/main/n/neon27/libneon27_0.28.2-6.1ubuntu0 .1_lpia.deb

Apple Mac OS X 10.6

• Apple MacOSXUpdCombo10.6.5.dmg
  For Mac OS X v10.6 - v10.6.3
  http://www.apple.com/support/downloads/

Mandriva Linux Mandrake 2009.0 x86_64

• Mandriva lib64neon0.26-0.26.4-6.2mdv2009.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64neon0.26-devel-0.26.4-6.2mdv2009.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64neon0.26-static-devel-0.26.4-6.2mdv2009.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64neon0.27-0.28.3-1.1mdv2009.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64neon0.27-devel-0.28.3-1.1mdv2009.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64neon0.27-static-devel-0.28.3-1.1mdv2009.0.x86_64.rpm
  http://www.mandriva.com/en/download/

Ubuntu Ubuntu Linux 9.04 amd64

• Ubuntu libneon25-dev_0.28.2-6.1ubuntu0.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/n/neon27/libneon25-dev_0.2 8.2-6.1ubuntu0.1_amd64.deb


• Ubuntu libneon27-dbg_0.28.2-6.1ubuntu0.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/n/neon27/libneon27-dbg_0.2 8.2-6.1ubuntu0.1_amd64.deb


• Ubuntu libneon27-dev_0.28.2-6.1ubuntu0.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/n/neon27/libneon27-dev_0.2 8.2-6.1ubuntu0.1_amd64.deb


• Ubuntu libneon27-gnutls-dbg_0.28.2-6.1ubuntu0.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/n/neon27/libneon27-gnutls- dbg_0.28.2-6.1ubuntu0.1_amd64.deb


• Ubuntu libneon27-gnutls-dev_0.28.2-6.1ubuntu0.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/n/neon27/libneon27-gnutls- dev_0.28.2-6.1ubuntu0.1_amd64.deb


• Ubuntu libneon27-gnutls_0.28.2-6.1ubuntu0.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/n/neon27/libneon27-gnutls_ 0.28.2-6.1ubuntu0.1_amd64.deb


• Ubuntu libneon27_0.28.2-6.1ubuntu0.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/n/neon27/libneon27_0.28.2- 6.1ubuntu0.1_amd64.deb

Mandriva Linux Mandrake 2009.1

• Mandriva libneon0.26-0.26.4-6.2mdv2009.1.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libneon0.26-devel-0.26.4-6.2mdv2009.1.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libneon0.26-static-devel-0.26.4-6.2mdv2009.1.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libneon0.27-0.28.3-2.1mdv2009.1.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libneon0.27-devel-0.28.3-2.1mdv2009.1.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libneon0.27-static-devel-0.28.3-2.1mdv2009.1.i586.rpm
  http://www.mandriva.com/en/download/

Ubuntu Ubuntu Linux 8.10 amd64

• Ubuntu libneon27-dbg_0.28.2-2ubuntu0.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/n/neon27/libneon27-dbg_0.2 8.2-2ubuntu0.1_amd64.deb


• Ubuntu libneon27-dev_0.28.2-2ubuntu0.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/n/neon27/libneon27-dev_0.2 8.2-2ubuntu0.1_amd64.deb


• Ubuntu libneon27-gnutls-dbg_0.28.2-2ubuntu0.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/n/neon27/libneon27-gnutls- dbg_0.28.2-2ubuntu0.1_amd64.deb


• Ubuntu libneon27-gnutls-dev_0.28.2-2ubuntu0.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/n/neon27/libneon27-gnutls- dev_0.28.2-2ubuntu0.1_amd64.deb


• Ubuntu libneon27-gnutls_0.28.2-2ubuntu0.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/n/neon27/libneon27-gnutls_ 0.28.2-2ubuntu0.1_amd64.deb


• Ubuntu libneon27_0.28.2-2ubuntu0.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/n/neon27/libneon27_0.28.2- 2ubuntu0.1_amd64.deb

Mandriva Linux Mandrake 2008.1 x86_64

• Mandriva lib64neon0.24-0.24.7-21.2mdv2008.1.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64neon0.24-devel-0.24.7-21.2mdv2008.1.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64neon0.24-static-devel-0.24.7-21.2mdv2008.1.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64neon0.26-0.26.4-5.2mdv2008.1.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64neon0.26-devel-0.26.4-5.2mdv2008.1.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64neon0.26-static-devel-0.26.4-5.2mdv2008.1.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64neon0.27-0.28.3-0.2mdv2008.1.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64neon0.27-devel-0.28.3-0.2mdv2008.1.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64neon0.27-static-devel-0.28.3-0.2mdv2008.1.x86_64.rpm
  http://www.mandriva.com/en/download/

Mandriva Linux Mandrake 2008.1

• Mandriva libneon0.24-0.24.7-21.2mdv2008.1.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libneon0.24-devel-0.24.7-21.2mdv2008.1.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libneon0.24-static-devel-0.24.7-21.2mdv2008.1.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libneon0.26-0.26.4-5.2mdv2008.1.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libneon0.26-devel-0.26.4-5.2mdv2008.1.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libneon0.26-static-devel-0.26.4-5.2mdv2008.1.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libneon0.27-0.28.3-0.2mdv2008.1.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libneon0.27-devel-0.28.3-0.2mdv2008.1.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libneon0.27-static-devel-0.28.3-0.2mdv2008.1.i586.rpm
  http://www.mandriva.com/en/download/

Mandriva Linux Mandrake 2009.1 x86_64

• Mandriva lib64neon0.26-0.26.4-6.2mdv2009.1.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64neon0.26-devel-0.26.4-6.2mdv2009.1.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64neon0.26-static-devel-0.26.4-6.2mdv2009.1.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64neon0.27-0.28.3-2.1mdv2009.1.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64neon0.27-devel-0.28.3-2.1mdv2009.1.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64neon0.27-static-devel-0.28.3-2.1mdv2009.1.x86_64.rpm
  http://www.mandriva.com/en/download/

Ubuntu Ubuntu Linux 8.10 i386

• Ubuntu libneon27-dbg_0.28.2-2ubuntu0.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/n/neon27/libneon27-dbg_0.2 8.2-2ubuntu0.1_i386.deb


• Ubuntu libneon27-dev_0.28.2-2ubuntu0.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/n/neon27/libneon27-dev_0.2 8.2-2ubuntu0.1_i386.deb


• Ubuntu libneon27-gnutls-dbg_0.28.2-2ubuntu0.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/n/neon27/libneon27-gnutls- dbg_0.28.2-2ubuntu0.1_i386.deb


• Ubuntu libneon27-gnutls-dev_0.28.2-2ubuntu0.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/n/neon27/libneon27-gnutls- dev_0.28.2-2ubuntu0.1_i386.deb


• Ubuntu libneon27-gnutls_0.28.2-2ubuntu0.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/n/neon27/libneon27-gnutls_ 0.28.2-2ubuntu0.1_i386.deb


• Ubuntu libneon27_0.28.2-2ubuntu0.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/n/neon27/libneon27_0.28.2- 2ubuntu0.1_i386.deb

MandrakeSoft Enterprise Server 5 x86_64

• Mandriva lib64neon0.26-0.26.4-6.2mdvmes5.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64neon0.26-devel-0.26.4-6.2mdvmes5.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64neon0.26-static-devel-0.26.4-6.2mdvmes5.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64neon0.27-0.28.3-1.1mdvmes5.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64neon0.27-devel-0.28.3-1.1mdvmes5.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64neon0.27-static-devel-0.28.3-1.1mdvmes5.x86_64.rpm
  http://www.mandriva.com/en/download/

Ubuntu Ubuntu Linux 6.06 LTS powerpc

• Ubuntu libneon25-dbg_0.25.5.dfsg-5ubuntu0.1_powerpc.deb
  http://security.ubuntu.com/ubuntu/pool/main/n/neon/libneon25-dbg_0.25. 5.dfsg-5ubuntu0.1_powerpc.deb


• Ubuntu libneon25-dev_0.25.5.dfsg-5ubuntu0.1_powerpc.deb
  http://security.ubuntu.com/ubuntu/pool/main/n/neon/libneon25-dev_0.25. 5.dfsg-5ubuntu0.1_powerpc.deb


• Ubuntu libneon25_0.25.5.dfsg-5ubuntu0.1_powerpc.deb
  http://security.ubuntu.com/ubuntu/pool/main/n/neon/libneon25_0.25.5.df sg-5ubuntu0.1_powerpc.deb

MandrakeSoft Enterprise Server 5

• Mandriva libneon0.26-0.26.4-6.2mdvmes5.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libneon0.26-devel-0.26.4-6.2mdvmes5.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libneon0.26-static-devel-0.26.4-6.2mdvmes5.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libneon0.27-0.28.3-1.1mdvmes5.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libneon0.27-devel-0.28.3-1.1mdvmes5.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libneon0.27-static-devel-0.28.3-1.1mdvmes5.i586.rpm
  http://www.mandriva.com/en/download/

Ubuntu Ubuntu Linux 8.04 LTS lpia

• Ubuntu libneon27-dbg_0.27.2-1ubuntu0.1_lpia.deb
  http://ports.ubuntu.com/pool/main/n/neon27/libneon27-dbg_0.27.2-1ubunt u0.1_lpia.deb


• Ubuntu libneon27-dev_0.27.2-1ubuntu0.1_lpia.deb
  http://ports.ubuntu.com/pool/main/n/neon27/libneon27-dev_0.27.2-1ubunt u0.1_lpia.deb


• Ubuntu libneon27-gnutls-dbg_0.27.2-1ubuntu0.1_lpia.deb
  http://ports.ubuntu.com/pool/main/n/neon27/libneon27-gnutls-dbg_0.27.2 -1ubuntu0.1_lpia.deb


• Ubuntu libneon27-gnutls-dev_0.27.2-1ubuntu0.1_lpia.deb
  http://ports.ubuntu.com/pool/main/n/neon27/libneon27-gnutls-dev_0.27.2 -1ubuntu0.1_lpia.deb


• Ubuntu libneon27-gnutls_0.27.2-1ubuntu0.1_lpia.deb
  http://ports.ubuntu.com/pool/main/n/neon27/libneon27-gnutls_0.27.2-1ub untu0.1_lpia.deb


• Ubuntu libneon27_0.27.2-1ubuntu0.1_lpia.deb
  http://ports.ubuntu.com/pool/main/n/neon27/libneon27_0.27.2-1ubuntu0.1 _lpia.deb

Neon Client Library 0.19.3

• Neon neon-0.28.6.tar.gz
  http://www.webdav.org/neon/neon-0.28.6.tar.gz

Neon Client Library 0.23

• Neon neon-0.28.6.tar.gz
  http://www.webdav.org/neon/neon-0.28.6.tar.gz

Neon Client Library 0.23.1

• Neon neon-0.28.6.tar.gz
  http://www.webdav.org/neon/neon-0.28.6.tar.gz

Neon Client Library 0.23.2

• Neon neon-0.28.6.tar.gz
  http://www.webdav.org/neon/neon-0.28.6.tar.gz

Neon Client Library 0.23.3

• Neon neon-0.28.6.tar.gz
  http://www.webdav.org/neon/neon-0.28.6.tar.gz

Neon Client Library 0.23.4

• Neon neon-0.28.6.tar.gz
  http://www.webdav.org/neon/neon-0.28.6.tar.gz

Neon Client Library 0.23.6

• Neon neon-0.28.6.tar.gz
  http://www.webdav.org/neon/neon-0.28.6.tar.gz

Neon Client Library 0.23.7

• Neon neon-0.28.6.tar.gz
  http://www.webdav.org/neon/neon-0.28.6.tar.gz

Neon Client Library 0.23.8

• Neon neon-0.28.6.tar.gz
  http://www.webdav.org/neon/neon-0.28.6.tar.gz

Neon Client Library 0.24.1

• Neon neon-0.28.6.tar.gz
  http://www.webdav.org/neon/neon-0.28.6.tar.gz

Neon Client Library 0.24.2

• Neon neon-0.28.6.tar.gz
  http://www.webdav.org/neon/neon-0.28.6.tar.gz

Neon Client Library 0.24.3

• Neon neon-0.28.6.tar.gz
  http://www.webdav.org/neon/neon-0.28.6.tar.gz

Neon Client Library 0.24.4

• Neon neon-0.28.6.tar.gz
  http://www.webdav.org/neon/neon-0.28.6.tar.gz

Neon Client Library 0.24.5

• Neon neon-0.28.6.tar.gz
  http://www.webdav.org/neon/neon-0.28.6.tar.gz

Neon Client Library 0.24.6

• Neon neon-0.28.6.tar.gz
  http://www.webdav.org/neon/neon-0.28.6.tar.gz

Neon Client Library 0.26

• Neon neon-0.28.6.tar.gz
  http://www.webdav.org/neon/neon-0.28.6.tar.gz

Neon Client Library 0.26.1

• Neon neon-0.28.6.tar.gz
  http://www.webdav.org/neon/neon-0.28.6.tar.gz

Neon Client Library 0.26.2

• Neon neon-0.28.6.tar.gz
  http://www.webdav.org/neon/neon-0.28.6.tar.gz

Neon Client Library 0.26.3

• Neon neon-0.28.6.tar.gz
  http://www.webdav.org/neon/neon-0.28.6.tar.gz

Neon Neon 0.28

• Neon neon-0.28.6.tar.gz
  http://www.webdav.org/neon/neon-0.28.6.tar.gz

Neon Neon 0.28.1

• Neon neon-0.28.6.tar.gz
  http://www.webdav.org/neon/neon-0.28.6.tar.gz

Neon Neon 0.28.2

• Neon neon-0.28.6.tar.gz
  http://www.webdav.org/neon/neon-0.28.6.tar.gz

Neon Neon 0.28.3

• Neon neon-0.28.6.tar.gz
  http://www.webdav.org/neon/neon-0.28.6.tar.gz

Neon Neon 0.28.5

• Neon neon-0.28.6.tar.gz
  http://www.webdav.org/neon/neon-0.28.6.tar.gz

Apple Mac OS X Server 10.6.1

• Apple MacOSXServUpdCombo10.6.5.dmg
  For Mac OS X Server v10.6 - v10.6.3
  http://www.apple.com/support/downloads/

Apple Mac OS X 10.6.1

• Apple MacOSXUpdCombo10.6.5.dmg
  For Mac OS X v10.6 - v10.6.3
  http://www.apple.com/support/downloads/

Apple Mac OS X Server 10.6.2

• Apple MacOSXServUpdCombo10.6.5.dmg
  For Mac OS X Server v10.6 - v10.6.3
  http://www.apple.com/support/downloads/

Apple Mac OS X 10.6.3

• Apple MacOSXUpdCombo10.6.5.dmg
  For Mac OS X v10.6 - v10.6.3
  http://www.apple.com/support/downloads/

Apple Mac OS X 10.6.4

• Apple MacOSXUpd10.6.5.dmg
  For Mac OS X v10.6.4
  http://www.apple.com/support/downloads/

Apple Mac OS X Server 10.6.4

• Apple MacOSXServerUpd10.6.5.dmg
  For Mac OS X Server v10.6.4
  http://www.apple.com/support/downloads/

MandrakeSoft Multi Network Firewall 2.0

• Mandriva libneon0.24-0.24.7-1.1.101mdk.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libneon0.24-devel-0.24.7-1.1.101mdk.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libneon0.24-static-devel-0.24.7-1.1.101mdk.i586.rpm
  http://www.mandriva.com/en/download/

MandrakeSoft Corporate Server 3.0

• Mandriva libneon0.24-0.24.7-1.1.101mdk.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libneon0.24-devel-0.24.7-1.1.101mdk.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva libneon0.24-static-devel-0.24.7-1.1.101mdk.i586.rpm
  http://www.mandriva.com/en/download/

MandrakeSoft Corporate Server 3.0 x86_64

• Mandriva lib64neon0.24-0.24.7-1.1.101mdk.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64neon0.24-devel-0.24.7-1.1.101mdk.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva lib64neon0.24-static-devel-0.24.7-1.1.101mdk.x86_64.rpm
  http://www.mandriva.com/en/download/

Neon NULL Character CA SSL Certificate Validation Security Bypass Vulnerability

References:

• CVE-2009-2474: fix handling of NUL in SSL cert subject names (Joe Orton)
  
• Neon Homepage (Neon)
  
• neon: release 0.28.6 (SECURITY) (Joe Orton)
  
• TortoiseSVN 1.6.5 released (TortoiseSVN)
  
• ASA-2009-431: neon security update (RHSA-2009-1452) (Avaya)