CVE-2009-2702

Published: 08 September 2009

KDE KSSL in kdelibs 3.5.4, 4.2.4, and 4.3 does not properly handle a '\0' character in a domain name in the Subject Alternative Name field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.

Status

Notes

kde4libs not as serious since KDE4 has moved to Qt4. However,
it should be fixed due to other applications may use it. Also, by
nad checin verification (ie non-netowork) will use kssl.

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2702
• https://ubuntu.com/security/notices/USN-833-1
• NVD
• Launchpad
• Debian