Title: Neon NULL Character CA SSL Certificate Validation Security Bypass Vulnerability
Severity: CRITICAL
Description:
Neon is an HTTP and WebDAV client library.
Neon is prone to a security-bypass vulnerability that occurs because it fails to properly validate the domain name in a signed CA certificate. Specifically, the application stops reading the domain name when it encounters a NULL character. However, an attacker can acquire a legitimate certificate for a subdomain that contains a NULL character. Such a subdomain may look like 'example.net\0example.com' where the attacker owns 'example.com' and wishes to impersonate 'example.net'.
This issue affects Neon when compiled against OpenSSL.
Successfully exploiting this issue allows attackers to perform man-in-the-middle attacks or impersonate trusted servers, which will aid in further attacks.
Versions prior to Neon 0.28.6 are vulnerable. Additional applications that use the affected library may also be vulnerable.
Affected Products:
- MandrakeSoft Corporate Server 4.0
- MandrakeSoft Corporate Server 4.0.0 x86_64
- MandrakeSoft Enterprise Server 5
- MandrakeSoft Enterprise Server 5 x86_64
- MandrakeSoft Linux Mandrake 2008.1
- MandrakeSoft Linux Mandrake 2008.1 x86_64
- MandrakeSoft Linux Mandrake 2009.0
- MandrakeSoft Linux Mandrake 2009.0 x86_64
- MandrakeSoft Linux Mandrake 2009.1
- MandrakeSoft Linux Mandrake 2009.1 x86_64
- Neon Client Library 0.19.3
- Neon Client Library 0.23.0
- Neon Client Library 0.23.1
- Neon Client Library 0.23.2
- Neon Client Library 0.23.3
- Neon Client Library 0.23.4
- Neon Client Library 0.23.5
- Neon Client Library 0.23.6
- Neon Client Library 0.23.7
- Neon Client Library 0.23.8
- Neon Client Library 0.24.0
- Neon Client Library 0.24.1
- Neon Client Library 0.24.2
- Neon Client Library 0.24.3
- Neon Client Library 0.24.4
- Neon Client Library 0.24.5
- Neon Client Library 0.24.6
- Neon Client Library 0.26.0
- Neon Client Library 0.26.1
- Neon Client Library 0.26.2
- Neon Client Library 0.26.3
- Neon Neon 0.28.0
- Neon Neon 0.28.0
- Neon Neon 0.28.1
- Neon Neon 0.28.2
- Neon Neon 0.28.3
- Neon Neon 0.28.5
- Pardus Linux 2009
- RedHat Fedora 10
- RedHat Fedora 11
References:
- CVE: CVE-2009-2474
- Joe Orton: CVE-2009-2474: fix handling of NUL in SSL cert subject names
- Joe Orton: neon: release 0.28.6 (SECURITY)
- Neon: Neon Homepage
Juniper Networks provides this content via a wide variety of sources and production methods. If notified of errors or omissions in the content of this page, Juniper Networks, at its discretion, will modify or remove the page or leave the content as is, depending on various factors including but not limited to the reputation and authority of the party providing the notification. Please use the contact information displayed elsewhere on this page to report any errors or omissions regarding the content on this page.
