What’s Vulnerable › Vulnerabilities

CVE-2009-2408

• Severity: medium (CVSS 5.9 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 5.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2009-07-30 · updated 2026-06-16
• Weakness: CWE-295

Description

Mozilla Network Security Services (NSS) before 3.12.3, Firefox before 3.0.13, Thunderbird before 2.0.0.23, and SeaMonkey before 1.1.18 do not properly handle a '\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority. NOTE: this was originally reported for Firefox before 3.5.

Affected products

• Canonical Ubuntu Linux: 8.04, 8.10, 9.04
• Debian Linux: 5.0
• Mozilla Firefox: before 3.0.13 — fixed in 3.0.13
• Mozilla Network Security Services: before 3.12.3 — fixed in 3.12.3
• Mozilla Seamonkey: before 1.1.18 — fixed in 1.1.18
• Mozilla Thunderbird: before 2.0.0.23 — fixed in 2.0.0.23
• Opensuse: from 10.3 through 11.1
• SUSE Linux Enterprise: 10.0, 11.0
• SUSE Linux Enterprise Server: 9

How to fix

Upgrade to a fixed version: Mozilla Firefox 3.0.13; Mozilla Network Security Services 3.12.3; Mozilla Seamonkey 1.1.18; Mozilla Thunderbird 2.0.0.23. Check the vendor advisory for mitigations.

References

• http://isc.sans.org/diary.html?storyid=7003
• http://lists.opensuse.org/opensuse-security-announce/2009-11/msg00004.html
• http://marc.info/?l=oss-security&m=125198917018936&w=2
• http://osvdb.org/56723
• http://secunia.com/advisories/36088
• http://secunia.com/advisories/36125
• http://secunia.com/advisories/36139
• http://secunia.com/advisories/36157
• http://secunia.com/advisories/36434
• http://secunia.com/advisories/36669
• http://secunia.com/advisories/37098
• http://sunsolve.sun.com/search/document.do?assetkey=1-77-1021030.1-1

Get alerted when CVE-2009-2408 or the next vulnerability affects your stack