« Volver al listado

CVE-2009-3477

Estado: ModificadaMedia (6.8)—

The Blackberry Browser in RIM BlackBerry Device Software 4.5.0 before 4.5.0.173, 4.6.0 before 4.6.0.303, 4.6.1 before 4.6.1.309, 4.7.0 before 4.7.0.179, and 4.7.1 before 4.7.1.57 does not properly handle "hidden" characters including a '\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows remote man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

RIM — Blackberry Device Software

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2009-3477",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.8,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2009-09-29T23:30:00.297",
  "references": [
    {
      "url": "http://secunia.com/advisories/36875",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.blackberry.com/btsc/viewContent.do?externalId=KB19552",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/36528",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securitytracker.com/id?1022951",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/53490",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/36875",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.blackberry.com/btsc/viewContent.do?externalId=KB19552",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/36528",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securitytracker.com/id?1022951",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/53490",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-310"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Blackberry Browser in RIM BlackBerry Device Software 4.5.0 before 4.5.0.173, 4.6.0 before 4.6.0.303, 4.6.1 before 4.6.1.309, 4.7.0 before 4.7.0.179, and 4.7.1 before 4.7.1.57 does not properly handle \"hidden\" characters including a '\\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows remote man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408."
    },
    {
      "lang": "es",
      "value": "El Navegador de Blackberry en RIM BlackBerry Device Software v4.5.0 anterior a v4.5.0.173, 4.6.0 anterior a v4.6.0.303, 4.6.1 anterior a v4.6.1.309, 4.7.0 anterior a v4.7.0.179, y 4.7.1 anterior a v4.7.1.57 no maneja apropiadamente caracteres \"ocultos\" incluyendo un carácter '\\0' en un nombre de dominio en el campo nombre común (NC) de un certificado X.509, lo cual permite a atacantes hombre-en-el-medio (man-in-the-middle) remotos suplantar servidores SSL a su elección a través de de un certificado manipulado expedido por una Autoridad de Certificación legítima, un tema relacionado con CVE-2009-2408."
    }
  ],
  "lastModified": "2026-06-16T23:11:40.963",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:rim:blackberry_device_software:4.5.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EA413B7D-D802-4E3C-A7B6-336A18725F22"
            },
            {
              "criteria": "cpe:2.3:a:rim:blackberry_device_software:4.6:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9AA30719-43F4-4E82-BAAE-3BE053AB500A"
            },
            {
              "criteria": "cpe:2.3:a:rim:blackberry_device_software:4.6.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "01B0686F-CEE0-49DB-8393-C1100E13AD75"
            },
            {
              "criteria": "cpe:2.3:a:rim:blackberry_device_software:4.7:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E36C6DD2-3695-4D65-B4F5-ADA6C3E69AA2"
            },
            {
              "criteria": "cpe:2.3:a:rim:blackberry_device_software:4.7.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "59C49F10-787E-4AFB-8830-E6C3645BD2E7"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}