CVE-2009-3490

Debian Bug report logs - #549293 CVE-2009-3490: does not properly handle a '\0' character in a domain name in the Common Name field of an X509 certificate Package: wget; Maintainer for wget is Noël Köthe <noel@debianorg>; Source for wget is src:wget (PTS, buildd, popcon) Reported by: Giuseppe Iuculano <giuseppe@iucula ...

It was discovered that Wget did not correctly handle SSL certificates with zero bytes in the Common Name A remote attacker could exploit this to perform a man in the middle attack to view sensitive information or alter encrypted communications ...

Daniel Stenberg discovered that wget, a network utility to retrieve files from the Web using HTTP(S) and FTP, is vulnerable to the "Null Prefix Attacks Against SSL/TLS Certificates" published at the Blackhat conference some time ago This allows an attacker to perform undetected man-in-the-middle attacks via a crafted ITU-T X509 certificate with a ...