Unscored severity · published Sep 29, 2009
CVE-2009-3477
The Blackberry Browser in RIM BlackBerry Device Software 4.5.0 before 4.5.0.173, 4.6.0 before 4.6.0.303, 4.6.1 before 4.6.1.309, 4.7.0 before 4.7.0.179, and 4.7.1 before 4.7.1.57…
–
CVSS
0.6%
EPSS
No
On KEV
Description
The Blackberry Browser in RIM BlackBerry Device Software 4.5.0 before 4.5.0.173, 4.6.0 before 4.6.0.303, 4.6.1 before 4.6.1.309, 4.7.0 before 4.7.0.179, and 4.7.1 before 4.7.1.57 does not properly handle "hidden" characters including a '\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows remote man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 50% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BD
Blackberry Device Software · Rim
4.5.0; 4.6; 4.6.1; 4.7; 4.7.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2009-3477
CVE.org
https://www.cve.org/CVERecord?id=CVE-2009-3477
Vendor Advisory
http://secunia.com/advisories/36875
Vendor Advisory
http://www.blackberry.com/btsc/viewContent.do?externalId=KB19552
www.securityfocus.com
http://www.securityfocus.com/bid/36528
www.securitytracker.com
http://www.securitytracker.com/id?1022951
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/53490
More from Blackberry Device Software
–
CVE-2010-3934
The browser in Research In Motion (RIM) BlackBerry Device Software 5.0.0.593 Platform 5.1.0.147 on the BlackBerry 9700 does not properly restrict cross-domain execution of…
–
CVE-2005-2343
Research in Motion (RIM) BlackBerry Handheld web browser for BlackBerry Handheld before 4.0.2 allows remote attackers to cause a denial of service (hang) via a Java Application…