Vulnerability Details : CVE-2009-2702
KDE KSSL in kdelibs 3.5.4, 4.2.4, and 4.3 does not properly handle a '\0' character in a domain name in the Subject Alternative Name field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.
Exploit prediction scoring system (EPSS) score for CVE-2009-2702
Probability of exploitation activity in the next 30 days: 0.08%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 32 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2009-2702
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
|---|---|---|---|---|---|
|
7.5
|
HIGH | AV:N/AC:L/Au:N/C:P/I:P/A:P |
10.0
|
6.4
|
NIST |
CWE ids for CVE-2009-2702
-
Assigned by: nvd@nist.gov (Primary)
Vendor statements for CVE-2009-2702
-
Red Hat 2009-09-18Red Hat is aware of this issue and is tracking it via the following bug: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2009-2702 This issue did not affect kdelibs packages as shipped in Red Hat Enterprise Linux 3 and 4. The Red Hat Security Response Team has rated this issue as having low security impact, a future update may address this flaw in Red Hat Enterprise Linux 5.
- cpe:2.3:a:kde:kdelibs:4.3:*:*:*:*:*:*:*
- cpe:2.3:a:kde:kdelibs:3.5.4:*:*:*:*:*:*:*
- cpe:2.3:a:kde:kdelibs:4.2.4:*:*:*:*:*:*:*