Schweregrad:: Mittel
  CVE Kennungen:: CVE-2009-2510,MS09-056
  Hinweisdatum: 02 März 2011

  Beschreibung

Microsoft Internet Explorer is prone to a security-bypass vulnerability because it fails to properly validate the domain name in a signed CA certificate, allowing attackers to substitute malicious SSL certificates for trusted ones. Successful exploits allow attackers to perform man-in-the-middle attacks or impersonate trusted servers, which will aid in further attacks. The CryptoAPI component in Microsoft Windows 2000 SP4, Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista Gold, SP1, and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7, as used by Internet Explorer and other applications, does not properly handle a '\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, aka "Null Truncation in X.509 Common Name Vulnerability," a related issue to CVE-2009-2408.

  Trend Micro Lösungen

Trend Micro Deep Security shields networks through Deep Packet Inspection (DPI) rules. Trend Micro customers using OfficeScan with Intrusion Defense Firewall (IDF) plugin are also protected from attacks using these vulnerabilities. Please refer to the filter number and filter name when applying appropriate DPI and/or IDF rules.

  Lösungen

  Trend Micro Deep Security DPI Rule Number: 1003670
  Trend Micro Deep Security DPI Rule Name: 1003670 - Multiple Browser Certificate Regexp Parsing Heap Overflow

  Betroffene Software und Version:

  • Microsoft Windows XP-
  • Microsoft Windows XP
  • Microsoft Windows Vista
  • Microsoft Windows Server 2008
  • Microsoft Windows Server 2008-
  • Microsoft Windows 7-
  • Microsoft Windows 2003 Server
  • Microsoft Windows 2000