|
|
CVE Reference: CVE-2008-0555 |
|
| NOTE: The text on this page is written by CVE MITRE and reflects neither the opinions of Secunia or the results of our research. All data on this page is written and maintained by CVE MITRE. | |
|
Original Page at CVE MITRE: CVE-2008-0555 |
|
|
Description: The ExpandCert function in Apache-SSL before apache_1.3.41+ssl_1.59 does not properly handle (1) '/' and (2) '=' characters in a Distinguished Name (DN) in a client certificate, which might allow remote attackers to bypass authentication via a crafted DN that triggers overwriting of environment variables. |
|
|
CVE Status: Candidate |
|
|
References: ST 1019784 SREASON http://securityreason.com/securityalert/3797 SAID Secunia Advisory: SA29644 MISC http://www.klink.name/security/aklink-sa-2008-005-apache-ssl.txt http://www.cynops.de/advisories/CVE-2008-0555.txt http://www.apache-ssl.org/advisory-cve-2008-0555.txt BUGTRAQ http://www.securityfocus.com/archive/1/archive/1/490386/100/0/threaded BID 28576 |
|
| Return to the previous page. |
