Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2009-2409: Debian NSS and OpenSSL libraries allow forged certificates

CVE-2009-2409 · published 17 years ago

Summary

Older Debian versions of the NSS and OpenSSL libraries still accept MD2 signatures on X.509 certificates. Because MD2 is weak, an attacker could create a fake certificate that appears trusted. Update the NSS and OpenSSL packages to the latest releases that no longer accept MD2 signatures.

What to do

Update debian nss to version 3.12.3-1.
Update debian openssl to version 0.9.8k-4.
Update mozilla network_security_services to version 3.12.3 or later.

Affected software

Ecosystem	Vendor	Product	Affected versions
Debian:12	debian	nss	< 3.12.3-1 Fix: upgrade to 3.12.3-1
Debian:13	debian	nss	< 3.12.3-1 Fix: upgrade to 3.12.3-1
Debian:14	debian	nss	< 3.12.3-1 Fix: upgrade to 3.12.3-1
Debian:12	debian	openssl	< 0.9.8k-4 Fix: upgrade to 0.9.8k-4
Debian:13	debian	openssl	< 0.9.8k-4 Fix: upgrade to 0.9.8k-4
Debian:14	debian	openssl	< 0.9.8k-4 Fix: upgrade to 0.9.8k-4
–	gnu	gnutls	< 2.6.4 >= 2.7.0, < 2.7.4 `cpe:2.3:a:gnu:gnutls::::::::`
–	mozilla	network_security_services	< 3.12.3 `cpe:2.3:a:mozilla:network_security_services::::::::`
–	openssl	openssl	>= 0.9.8, <= 0.9.8k `cpe:2.3:a:openssl:openssl::::::::`

Original advisory text

The Network Security Services (NSS) library before 3.12.3, as used in Firefox; GnuTLS before 2.6.4 and 2.7.4; OpenSSL 0.9.8 through 0.9.8k; and other products support MD2 with X.509 certificates, which might allow remote attackers to spoof certificates by using MD2 design flaws to generate a hash collision in less than brute-force time. NOTE: the scope of this issue is currently limited because the amount of computation required is still large.

References

https://security-tracker.debian.org/tracker/CVE-2009-2409 Vendor Advisory
http://java.sun.com/j2se/1.5.0/ReleaseNotes.html Patch
http://java.sun.com/javase/6/webnotes/6u17.html Release Notes
http://lists.apple.com/archives/security-announce/2009/Nov/msg00000.html Vendor Advisory
http://secunia.com/advisories/36139 Vendor Advisory
http://secunia.com/advisories/36157 Vendor Advisory
http://secunia.com/advisories/36434 Vendor Advisory
http://secunia.com/advisories/36669 Not Applicable
http://secunia.com/advisories/36739 Not Applicable
http://secunia.com/advisories/37386 Not Applicable
http://secunia.com/advisories/42467 Not Applicable
http://security.gentoo.org/glsa/glsa-200911-02.xml Third Party Advisory
http://security.gentoo.org/glsa/glsa-200912-01.xml Third Party Advisory
http://support.apple.com/kb/HT3937 Broken Link
http://www.debian.org/security/2009/dsa-1874 Mailing List
http://www.mandriva.com/security/advisories?name=MDVSA-2009:197 Not Applicable
http://www.mandriva.com/security/advisories?name=MDVSA-2009:216 Not Applicable
http://www.mandriva.com/security/advisories?name=MDVSA-2009:258 Not Applicable
http://www.mandriva.com/security/advisories?name=MDVSA-2010:084 Not Applicable
http://www.redhat.com/support/errata/RHSA-2009-1207.html Third Party Advisory
http://www.redhat.com/support/errata/RHSA-2009-1432.html Third Party Advisory
http://www.securityfocus.com/archive/1/515055/100/0/threaded Broken Link
http://www.securitytracker.com/id?1022631 Broken Link
http://www.ubuntu.com/usn/usn-810-1 Third Party Advisory
http://www.vmware.com/security/advisories/VMSA-2010-0019.html Third Party Advisory
http://www.vupen.com/english/advisories/2009/2085 Vendor Advisory
http://www.vupen.com/english/advisories/2009/3184 Vendor Advisory
http://www.vupen.com/english/advisories/2010/3126 Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2009-2409 Third Party Advisory
https://lists.balabit.com/pipermail/syslog-ng-announce/2011-January/000101.html Third Party Advisory
https://lists.balabit.com/pipermail/syslog-ng-announce/2011-January/000102.html Third Party Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3... Broken Link
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3... Broken Link
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3... Broken Link
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3... Broken Link
https://rhn.redhat.com/errata/RHSA-2010-0095.html Third Party Advisory
https://usn.ubuntu.com/810-2/ Broken Link
https://www.debian.org/security/2009/dsa-1888 Mailing List Third Party Advisory

Severity

5.1 Medium

Exploitation

4% chance of attack within 30 days

Type

CWE-295Improper Certificate Validation

Timeline

Published30 Jul 2009

Updated24 Oct 2026

First seen17 Sep 2026

Sources

DEBIAN-CVE-2009-2409 · OSV

CVE-2009-2409 · NVD

Track software like this

Free during beta