CVE-2009-3767: apple mac_os_x Improper Certificate Validation
Vulnerability summary
CVE-2009-3767 is a medium (CVSS 4.3) Improper Certificate Validation vulnerability in apple mac_os_x. EPSS estimates a 3.26% chance of exploitation in the next 30 days, higher than 88.2% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 1Timeline
- 23-10-2009PublishedVulnerability first disclosed.
- 07-08-2024Last modifiedVulnerability information updated.
Description
libraries/libldap/tls_o.c in OpenLDAP 2.2 and 2.4, and possibly other versions, when OpenSSL is used, does not properly handle a '\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
3.26%
Chance of exploitation in the next 30 days
Percentile
88%
Versus all other CVEs
30-day change
-0.02 pp
From 3.27% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Redhat8 products
- compat-openldap< 0:2.3.43_2.2.29-12.el5
- openldap< 0:2.3.43-12.el5
- openldap-clients< 0:2.3.43-12.el5
- openldap-debuginfo< 0:2.3.43-12.el5
- openldap-devel< 0:2.3.43-12.el5
Debian2 products
- openldap< 2.4.17-2.1 | < 2.4.11-1+lenny1
- openldap2.3< 2.3.30-5+etch3
Apple1 product
- mac_os_x< 10.6.2
Fedoraproject1 product
- fedoraEOL11
Openldap1 product
- openldap< 2.4.18
5 vendors · 13 products
References
37 links- lists.fedoraproject.org/pipermail/package-announce/2010-March/036138.htmlVendor AdvisoryX Refsource FEDORAThird Party Advisory
- oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11178VDB EntrySignatureX Refsource OVALThird Party Advisory
- oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7274VDB EntrySignatureX Refsource OVALThird Party Advisory
- www.openldap.org/devel/cvsweb.cgi/libraries/libldap/tls_o.c.diff?r1=1.8&r2=1.11&f=hX Refsource CONFIRMPatchVendor Advisory
- www.redhat.com/support/errata/RHSA-2010-0543.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory
Show all 37 references
- www.redhat.com/support/errata/RHSA-2011-0896.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
- lists.apple.com/archives/security-announce/2009/Nov/msg00000.htmlVendor AdvisoryX Refsource APPLEMailing ListThird Party Advisory
