Vulnerability Details : CVE-2009-4565
sendmail before 8.14.4 does not properly handle a '\0' character in a Common Name (CN) field of an X.509 certificate, which (1) allows man-in-the-middle attackers to spoof arbitrary SSL-based SMTP servers via a crafted server certificate issued by a legitimate Certification Authority, and (2) allows remote attackers to bypass intended access restrictions via a crafted client certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.
Threat overview for CVE-2009-4565
Top countries where our scanners detected CVE-2009-4565
Top open port discovered on systems with this issue
80
IPs affected by CVE-2009-4565 660
Threat actors abusing to this issue?
Yes
Find out if you* are
affected by CVE-2009-4565!
*Directly or indirectly through your vendors, service providers and 3rd parties.
Powered by
attack surface intelligence
from SecurityScorecard.
Exploit prediction scoring system (EPSS) score for CVE-2009-4565
Probability of exploitation activity in the next 30 days: 0.54%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 74 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2009-4565
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
---|---|---|---|---|---|
7.5
|
HIGH | AV:N/AC:L/Au:N/C:P/I:P/A:P |
10.0
|
6.4
|
NIST |
CWE ids for CVE-2009-4565
-
Assigned by: nvd@nist.gov (Primary)
Vendor statements for CVE-2009-4565
-
Red Hat 2010-01-21Red Hat is aware of this issue and is tracking it via the following bug: https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=CVE-2009-4565 The Red Hat Security Response Team has rated this issue as having low security impact, a future update may address this flaw.
-
http://www.securityfocus.com/bid/37543
-
http://www.debian.org/security/2010/dsa-1985
-
http://lists.opensuse.org/opensuse-security-announce/2010-03/msg00004.html
[security-announce] SUSE Security Summary Report: SUSE-SR:2010:006
-
http://sunsolve.sun.com/search/document.do?assetkey=1-77-1021797.1-1
-
http://security.gentoo.org/glsa/glsa-201206-30.xml
-
http://www.vupen.com/english/advisories/2009/3661
Patch;Vendor Advisory
-
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11822
-
http://www.vupen.com/english/advisories/2010/1386
-
http://www.vupen.com/english/advisories/2010/0719
-
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10255
-
http://marc.info/?l=bugtraq&m=126953289726317&w=2
-
http://www.sendmail.org/releases/8.14.4
Patch
-
http://www.vupen.com/english/advisories/2011/0415
-
http://www.redhat.com/support/errata/RHSA-2011-0262.html
- cpe:2.3:a:sendmail:sendmail:*:*:*:*:*:*:*:*
- cpe:2.3:a:sendmail:sendmail:5.59:*:*:*:*:*:*:*
- cpe:2.3:a:sendmail:sendmail:5.65:*:*:*:*:*:*:*
- cpe:2.3:a:sendmail:sendmail:5.61:*:*:*:*:*:*:*
- cpe:2.3:a:sendmail:sendmail:5:*:*:*:*:*:*:*
- cpe:2.3:a:sendmail:sendmail:8.12:beta10:*:*:*:*:*:*
- cpe:2.3:a:sendmail:sendmail:8.12:beta12:*:*:*:*:*:*
- cpe:2.3:a:sendmail:sendmail:8.11.0:*:*:*:*:*:*:*
- cpe:2.3:a:sendmail:sendmail:8.12:beta16:*:*:*:*:*:*
- cpe:2.3:a:sendmail:sendmail:8.12:beta5:*:*:*:*:*:*
- cpe:2.3:a:sendmail:sendmail:8.11.1:*:*:*:*:*:*:*
- cpe:2.3:a:sendmail:sendmail:8.11.2:*:*:*:*:*:*:*
- cpe:2.3:a:sendmail:sendmail:8.12:beta7:*:*:*:*:*:*
- cpe:2.3:a:sendmail:sendmail:8.11.3:*:*:*:*:*:*:*
- cpe:2.3:a:sendmail:sendmail:8.11.4:*:*:*:*:*:*:*
- cpe:2.3:a:sendmail:sendmail:8.11.5:*:*:*:*:*:*:*
- cpe:2.3:a:sendmail:sendmail:8.10.1:*:*:*:*:*:*:*
- cpe:2.3:a:sendmail:sendmail:8.10:*:*:*:*:*:*:*
- cpe:2.3:a:sendmail:sendmail:8.10.2:*:*:*:*:*:*:*
- cpe:2.3:a:sendmail:sendmail:8.12.4:*:*:*:*:*:*:*
- cpe:2.3:a:sendmail:sendmail:8.12.1:*:*:*:*:*:*:*
- cpe:2.3:a:sendmail:sendmail:8.12.3:*:*:*:*:*:*:*
- cpe:2.3:a:sendmail:sendmail:8.12.0:*:*:*:*:*:*:*
- cpe:2.3:a:sendmail:sendmail:8.12.2:*:*:*:*:*:*:*
- cpe:2.3:a:sendmail:sendmail:8.12.5:*:*:*:*:*:*:*
- cpe:2.3:a:sendmail:sendmail:8.12.6:*:*:*:*:*:*:*
- cpe:2.3:a:sendmail:sendmail:8.8.8:*:*:*:*:*:*:*
- cpe:2.3:a:sendmail:sendmail:8.9.0:*:*:*:*:*:*:*
- cpe:2.3:a:sendmail:sendmail:8.9.3:*:*:*:*:*:*:*
- cpe:2.3:a:sendmail:sendmail:8.11.6:*:*:*:*:*:*:*
- cpe:2.3:a:sendmail:sendmail:8.12.7:*:*:*:*:*:*:*
- cpe:2.3:a:sendmail:sendmail:8.9.1:*:*:*:*:*:*:*
- cpe:2.3:a:sendmail:sendmail:8.9.2:*:*:*:*:*:*:*
- cpe:2.3:a:sendmail:sendmail:8.10.0:*:*:*:*:*:*:*
- cpe:2.3:a:sendmail:sendmail:8.11.7:*:*:*:*:*:*:*
- cpe:2.3:a:sendmail:sendmail:2.6:*:*:*:*:*:*:*
- cpe:2.3:a:sendmail:sendmail:8.12.8:*:*:*:*:*:*:*
- cpe:2.3:a:sendmail:sendmail:3.0:*:*:*:*:*:*:*
- cpe:2.3:a:sendmail:sendmail:3.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:sendmail:sendmail:2.6.1:*:*:*:*:*:*:*
- cpe:2.3:a:sendmail:sendmail:8.12.9:*:*:*:*:*:*:*
- cpe:2.3:a:sendmail:sendmail:8.12.10:*:*:*:*:*:*:*
- cpe:2.3:a:sendmail:sendmail:8.13.2:*:*:*:*:*:*:*
- cpe:2.3:a:sendmail:sendmail:8.13.3:*:*:*:*:*:*:*
- cpe:2.3:a:sendmail:sendmail:8.13.0:*:*:*:*:*:*:*
- cpe:2.3:a:sendmail:sendmail:8.13.1:*:*:*:*:*:*:*
- cpe:2.3:a:sendmail:sendmail:8.13.4:*:*:*:*:*:*:*
- cpe:2.3:a:sendmail:sendmail:8.13.5:*:*:*:*:*:*:*
- cpe:2.3:a:sendmail:sendmail:8.13.1.2:*:*:*:*:*:*:*
- cpe:2.3:a:sendmail:sendmail:4.55:*:*:*:*:*:*:*
- cpe:2.3:a:sendmail:sendmail:8.13.7:*:*:*:*:*:*:*
- cpe:2.3:a:sendmail:sendmail:4.1:*:*:*:*:*:*:*
- cpe:2.3:a:sendmail:sendmail:8.13.6:*:*:*:*:*:*:*
- cpe:2.3:a:sendmail:sendmail:8.7.8:*:*:*:*:*:*:*
- cpe:2.3:a:sendmail:sendmail:8.7.7:*:*:*:*:*:*:*
- cpe:2.3:a:sendmail:sendmail:8.6.7:*:*:*:*:*:*:*
- cpe:2.3:a:sendmail:sendmail:8.7.6:*:*:*:*:*:*:*
- cpe:2.3:a:sendmail:sendmail:8.7.10:*:*:*:*:*:*:*
- cpe:2.3:a:sendmail:sendmail:8.7.9:*:*:*:*:*:*:*
- cpe:2.3:a:sendmail:sendmail:8.14.2:*:*:*:*:*:*:*
- cpe:2.3:a:sendmail:sendmail:8.13.8:*:*:*:*:*:*:*
- cpe:2.3:a:sendmail:sendmail:8.14.1:*:*:*:*:*:*:*