CVE-2009-3477

Severity: medium (CVSS 6.8 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2009-09-29 · updated 2026-06-16
Weakness: CWE-310

Description

The Blackberry Browser in RIM BlackBerry Device Software 4.5.0 before 4.5.0.173, 4.6.0 before 4.6.0.303, 4.6.1 before 4.6.1.309, 4.7.0 before 4.7.0.179, and 4.7.1 before 4.7.1.57 does not properly handle "hidden" characters including a '\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows remote man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.

Affected products

Rim Blackberry Device Software: 4.5.0, 4.6, 4.6.1, 4.7, 4.7.1

References

http://secunia.com/advisories/36875
http://www.blackberry.com/btsc/viewContent.do?externalId=KB19552
http://www.securityfocus.com/bid/36528
http://www.securitytracker.com/id?1022951
https://exchange.xforce.ibmcloud.com/vulnerabilities/53490
http://secunia.com/advisories/36875
http://www.blackberry.com/btsc/viewContent.do?externalId=KB19552
http://www.securityfocus.com/bid/36528
http://www.securitytracker.com/id?1022951
https://exchange.xforce.ibmcloud.com/vulnerabilities/53490

Get alerted when CVE-2009-3477 or the next vulnerability affects your stack