CVE-2009-2408: canonical ubuntu_linux Improper Certificate Validation
Vulnerability summary
CVE-2009-2408 is a medium (CVSS 6.8) Improper Certificate Validation vulnerability in canonical ubuntu_linux. EPSS estimates a 5.74% chance of exploitation in the next 30 days, higher than 93% of scored vulnerabilities.
Not severe (CVSS 5.9, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 7 · Duplicates 1Timeline
- 30-07-2009PublishedVulnerability first disclosed.
- 07-08-2024Last modifiedVulnerability information updated.
Description
Mozilla Network Security Services (NSS) before 3.12.3, Firefox before 3.0.13, Thunderbird before 2.0.0.23, and SeaMonkey before 1.1.18 do not properly handle a '\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority. NOTE: this was originally reported for Firefox before 3.5.
CVSS metrics
3 scores · 2 sources · 2 versions- OSV · DebianEcosystem advisory · calculated5.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
EPSS trend
Probability
5.74%
Chance of exploitation in the next 30 days
Percentile
93%
Versus all other CVEs
30-day change
Increase +0.78 pp
From 4.96% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Mozilla4 products
- firefox< 3.0.13
- network_security_services< 3.12.3
- seamonkey< 1.1.18
- thunderbird< 2.0.0.23
Debian2 products
- nss< 3.12.3-1
- debian_linuxEOL5.0
Suse2 products
- linux_enterprise10.0 | 11.0
- linux_enterprise_server9
Canonical1 product
- ubuntu_linuxEOL8.04 | 8.10 | 9.04
Opensuse1 product
- opensuse≥ 10.3, ≤ 11.1
5 vendors · 10 products
References
31 links- www.mandriva.com/security/advisories?name=MDVSA-2009:197Vendor AdvisoryX Refsource MANDRIVABroken Link
- www.novell.com/linux/security/advisories/2009_48_firefox.htmlVendor AdvisoryX Refsource SUSEBroken Link
- www.mandriva.com/security/advisories?name=MDVSA-2009:216Vendor AdvisoryX Refsource MANDRIVABroken Link
- lists.opensuse.org/opensuse-security-announce/2009-11/msg00004.htmlVendor AdvisoryX Refsource SUSEMailing List
Show all 31 references
- oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10751VDB EntrySignatureX Refsource OVALBroken Link
- oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8458VDB EntrySignatureX Refsource OVALBroken Link
- sunsolve.sun.com/search/document.do?assetkey=1-77-1021030.1-1Vendor AdvisoryX Refsource SUNALERTBroken Link
- www.openldap.org/devel/cvsweb.cgi/libraries/libldap/tls_m.c.diff?r1=1.8&r2=1.11&f=hX Refsource CONFIRMBroken Link
- www.mandriva.com/security/advisories?name=MDVSA-2009:217Vendor AdvisoryX Refsource MANDRIVABroken Link