CVE-2009-3639
Medium
Description
The mod_tls module in ProFTPD before 1.3.2b, and 1.3.3 before 1.3.3rc2, when the dNSNameRequired TLS option is enabled, does not properly handle a '\0' character in a domain name in the Subject Alternative Name field of an X.509 client certificate, which allows remote attackers to bypass intended client-hostname restrictions via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.
SeverityMedium
CVSS5.8
Exploit probability—
ProductProftpd
PublishedOct 28, 2009
First seenOct 28, 2009
How to fix
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| proftpd proftpd | v ≤ 1.3.2, 1.3.1, 1.3.2, 1.3.3 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.