The verify_hostname_of_cert function in the certificate checking feature in IO-Socket-SSL (IO::Socket::SSL) 1.14 through 1.25 only matches the prefix of a hostname when no wildcard is used, which allows remote attackers to bypass the hostname check for a certificate.

The remote host is affected by the vulnerability described in GLSA-201101-06 (IO::Socket::SSL: Certificate validation error)

    The vendor reported that IO::Socket::SSL does not properly handle     Common Name (CN) fields.
  Impact :

    A remote attacker might employ a specially crafted certificate to     conduct man-in-the-middle attacks on SSL connections made using     IO::Socket::SSL.
  Workaround :

    There is no known workaround at this time.

A vulnerability was discovered and corrected in perl-IO-Socket-SSL :

The verify_hostname_of_cert function in the certificate checking feature in IO-Socket-SSL (IO::Socket::SSL) 1.14 through 1.25 only matches the prefix of a hostname when no wildcard is used, which allows remote attackers to bypass the hostname check for a certificate (CVE-2009-3024).

This update provides a fix for this vulnerability.

Update :

Packages were missing for 2009.0, this update addresses the problem.

A vulnerability was discovered and corrected in perl-IO-Socket-SSL:

The verify_hostname_of_cert function in the certificate checking feature in IO-Socket-SSL (IO::Socket::SSL) 1.14 through 1.25 only matches the prefix of a hostname when no wildcard is used, which allows remote attackers to bypass the hostname check for a certificate (CVE-2009-3024).

This update provides a fix for this vulnerability.

This update of perl-IO-Socket-SSL improves the hostname checking of the SSL certificate. (CVE-2009-3024)

ID	Name	Product	Family	Severity
51536	GLSA-201101-06 : IO::Socket::SSL: Certificate validation error	Nessus	Gentoo Local Security Checks	medium
41960	Mandriva Linux Security Advisory : perl-IO-Socket-SSL (MDVSA-2009:252-1)	Nessus	Mandriva Local Security Checks	medium
41950	MDVSA-2009:178 : perl-IO-Socket-SSL	Nessus	Mandriva Local Security Checks	medium
41449	SuSE 11 Security Update : perl-IO-Socket-SSL (SAT Patch Number 1265)	Nessus	SuSE Local Security Checks	medium
40905	openSUSE Security Update : perl-IO-Socket-SSL (perl-IO-Socket-SSL-1264)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2009-3024

high

Tenable Plugins

medium

medium

medium

medium

medium