CVE-2009-2409

Currently unrated

Key Information:

Vendor
Mozilla
Status
Firefox
Firefox
Nss
Vendor
CVE Published:
30 July 2009

Summary

The Network Security Services (NSS) library before 3.12.3, as used in Firefox; GnuTLS before 2.6.4 and 2.7.4; OpenSSL 0.9.8 through 0.9.8k; and other products support MD2 with X.509 certificates, which might allow remote attackers to spoof certificates by using MD2 design flaws to generate a hash collision in less than brute-force time. NOTE: the scope of this issue is currently limited because the amount of computation required is still large.

References

http://secunia.com/advisories/36139
third-party-advisoryx_refsource_SECUNIA
http://secunia.com/advisories/36157
third-party-advisoryx_refsource_SECUNIA
http://www.mandriva.com/security/advisories?name=MDVSA-20...
vendor-advisoryx_refsource_MANDRIVA

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.