Oval Definition:	oval:org.mitre.oval:def:10940
Revision Date: 2013-04-29 Version: 12 Title: The vio_verify_callback function in viosslfactories.c in MySQL 5.0.x before 5.0.88 and 5.1.x before 5.1.41, when OpenSSL is used, accepts a value of zero for the depth of X.509 certificates, which allows man-in-the-middle attackers to spoof arbitrary SSL-based MySQL servers via a crafted certificate, as demonstrated by a certificate presented by a server linked against the yaSSL library. Description: The vio_verify_callback function in viosslfactories.c in MySQL 5.0.x before 5.0.88 and 5.1.x before 5.1.41, when OpenSSL is used, accepts a value of zero for the depth of X.509 certificates, which allows man-in-the-middle attackers to spoof arbitrary SSL-based MySQL servers via a crafted certificate, as demonstrated by a certificate presented by a server linked against the yaSSL library. Family: unix Class: vulnerability Status: ACCEPTED Reference(s): CVE-2009-4028 Platform(s): CentOS Linux 5 Oracle Linux 5 Red Hat Enterprise Linux 5 Product(s): Definition Synopsis RHEL5, CentOS5 or Oracle Linux 5 The operating system installed on the system is Red Hat Enterprise Linux 5 OR The operating system installed on the system is CentOS Linux 5.x OR Oracle Linux 5.x AND Configuration section mysql is earlier than 0:5.0.77-4.el5_4.2 OR mysql-devel is earlier than 0:5.0.77-4.el5_4.2 OR mysql-test is earlier than 0:5.0.77-4.el5_4.2 OR mysql-bench is earlier than 0:5.0.77-4.el5_4.2 OR mysql-server is earlier than 0:5.0.77-4.el5_4.2
BACK