製品・ソフトウェアに関する情報

JVN脆弱性詳細

Google Chrome における X.509 証明書の処理に関する任意の SSL サーバになりすまされる脆弱性

タイトル	Google Chrome における X.509 証明書の処理に関する任意の SSL サーバになりすまされる脆弱性
概要	Google Chrome には、X.509 証明書の subject's Common Name (CN) フィールド内のドメイン名にある '\0' 文字を適切に処理しないため、任意の SSL サーバになりすまされる脆弱性が存在します。本問題は、CVE-2009-2408 と関連する問題です。
想定される影響	攻撃者により、巧妙に細工された正規認証局発行の証明書を介して、任意の SSL サーバになりすまされる可能性があります。
対策	ベンダ情報及び参考情報を参照して適切な対策を実施してください。
公表日	2009年9月29日0:00
登録日	2010年10月19日15:01
最終更新日	2010年10月19日15:01

CVSS2.0 : 危険
スコア	7.5
ベクター	AV:N/AC:L/Au:N/C:P/I:P/A:P

影響を受けるシステム

Google

Google Chrome 3.0.195.21 およびそれ以前

CVE (情報セキュリティ共通脆弱性識別子)

No	名前	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2009-3456	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3456
National Vulnerability Database (NVD)
2	CVE-2009-3456	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-3456

CWE (共通脆弱性タイプ一覧)

No	名前	URL
JVNDB
1	CWE-310	https://jvndb.jvn.jp/ja/cwe/CWE-310.html

ベンダー情報

No	名前	URL
Google
1	beta-stable-channel-update_30	http://googlechromereleases.blogspot.com/2009/09/stable-channel-update_30.html
2	Google Chrome	http://www.google.com/chrome/intl/ja/landing.html?hl=ja

その他

No	名前	URL
SecurityFocus
1	36479	http://www.securityfocus.com/bid/36479

変更履歴

No	変更内容	変更日
0	[2010年10月19日] 掲載	2018年2月17日10:37

NVD脆弱性情報

CVE-2009-3456

概要	Google Chrome, possibly 3.0.195.21 and earlier, does not properly handle a '\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
公表日	2009年9月30日3:00
登録日	2021年1月29日13:23
最終更新日	2009年9月30日13:00

影響を受けるソフトウェアの構成

構成1	以上	以下	より上	未満
cpe:2.3:a:google:chrome:0.2.149.27:::::::*
cpe:2.3:a:google:chrome:0.2.149.29:::::::*
cpe:2.3:a:google:chrome:0.2.149.30:::::::*
cpe:2.3:a:google:chrome:0.2.152.1:::::::*
cpe:2.3:a:google:chrome:0.2.153.1:::::::*
cpe:2.3:a:google:chrome:0.3.154.0:::::::*
cpe:2.3:a:google:chrome:0.3.154.3:::::::*
cpe:2.3:a:google:chrome:0.4.154.18:::::::*
cpe:2.3:a:google:chrome:0.4.154.22:::::::*
cpe:2.3:a:google:chrome:0.4.154.31:::::::*
cpe:2.3:a:google:chrome:0.4.154.33:::::::*
cpe:2.3:a:google:chrome:1.0.154.36:::::::*
cpe:2.3:a:google:chrome:1.0.154.39:::::::*
cpe:2.3:a:google:chrome:1.0.154.42:::::::*
cpe:2.3:a:google:chrome:1.0.154.43:::::::*
cpe:2.3:a:google:chrome:1.0.154.46:::::::*
cpe:2.3:a:google:chrome:1.0.154.48:::::::*
cpe:2.3:a:google:chrome:1.0.154.52:::::::*
cpe:2.3:a:google:chrome:1.0.154.53:::::::*
cpe:2.3:a:google:chrome:1.0.154.59:::::::*
cpe:2.3:a:google:chrome:1.0.154.65:::::::*
cpe:2.3:a:google:chrome:2.0.156.1:::::::*
cpe:2.3:a:google:chrome:2.0.157.0:::::::*
cpe:2.3:a:google:chrome:2.0.157.2:::::::*
cpe:2.3:a:google:chrome:2.0.158.0:::::::*
cpe:2.3:a:google:chrome:2.0.159.0:::::::*
cpe:2.3:a:google:chrome:2.0.169.0:::::::*
cpe:2.3:a:google:chrome:2.0.169.1:::::::*
cpe:2.3:a:google:chrome:2.0.170.0:::::::*
cpe:2.3:a:google:chrome:2.0.172:::::::*
cpe:2.3:a:google:chrome:2.0.172.2:::::::*
cpe:2.3:a:google:chrome:2.0.172.8:::::::*
cpe:2.3:a:google:chrome:2.0.172.27:::::::*
cpe:2.3:a:google:chrome:2.0.172.28:::::::*
cpe:2.3:a:google:chrome:2.0.172.30:::::::*
cpe:2.3:a:google:chrome:2.0.172.31:::::::*
cpe:2.3:a:google:chrome:2.0.172.33:::::::*
cpe:2.3:a:google:chrome:2.0.172.37:::::::*
cpe:2.3:a:google:chrome:2.0.172.38:::::::*
cpe:2.3:a:google:chrome:3.0.182.2:::::::*
cpe:2.3:a:google:chrome:3.0.190.2:::::::*
cpe:2.3:a:google:chrome:3.0.193.2:beta::::::
cpe:2.3:a:google:chrome::::::::		3.0.195.21

構成1	以上	以下	より上	未満
cpe:2.3:a:google:chrome:0.2.149.27:::::::*
cpe:2.3:a:google:chrome:0.2.149.29:::::::*
cpe:2.3:a:google:chrome:0.2.149.30:::::::*
cpe:2.3:a:google:chrome:0.2.152.1:::::::*
cpe:2.3:a:google:chrome:0.2.153.1:::::::*
cpe:2.3:a:google:chrome:0.3.154.0:::::::*
cpe:2.3:a:google:chrome:0.3.154.3:::::::*
cpe:2.3:a:google:chrome:0.4.154.18:::::::*
cpe:2.3:a:google:chrome:0.4.154.22:::::::*
cpe:2.3:a:google:chrome:0.4.154.31:::::::*
cpe:2.3:a:google:chrome:0.4.154.33:::::::*
cpe:2.3:a:google:chrome:1.0.154.36:::::::*
cpe:2.3:a:google:chrome:1.0.154.39:::::::*
cpe:2.3:a:google:chrome:1.0.154.42:::::::*
cpe:2.3:a:google:chrome:1.0.154.43:::::::*
cpe:2.3:a:google:chrome:1.0.154.46:::::::*
cpe:2.3:a:google:chrome:1.0.154.48:::::::*
cpe:2.3:a:google:chrome:1.0.154.52:::::::*
cpe:2.3:a:google:chrome:1.0.154.53:::::::*
cpe:2.3:a:google:chrome:1.0.154.59:::::::*
cpe:2.3:a:google:chrome:1.0.154.65:::::::*
cpe:2.3:a:google:chrome:2.0.156.1:::::::*
cpe:2.3:a:google:chrome:2.0.157.0:::::::*
cpe:2.3:a:google:chrome:2.0.157.2:::::::*
cpe:2.3:a:google:chrome:2.0.158.0:::::::*
cpe:2.3:a:google:chrome:2.0.159.0:::::::*
cpe:2.3:a:google:chrome:2.0.169.0:::::::*
cpe:2.3:a:google:chrome:2.0.169.1:::::::*
cpe:2.3:a:google:chrome:2.0.170.0:::::::*
cpe:2.3:a:google:chrome:2.0.172:::::::*
cpe:2.3:a:google:chrome:2.0.172.2:::::::*
cpe:2.3:a:google:chrome:2.0.172.8:::::::*
cpe:2.3:a:google:chrome:2.0.172.27:::::::*
cpe:2.3:a:google:chrome:2.0.172.28:::::::*
cpe:2.3:a:google:chrome:2.0.172.30:::::::*
cpe:2.3:a:google:chrome:2.0.172.31:::::::*
cpe:2.3:a:google:chrome:2.0.172.33:::::::*
cpe:2.3:a:google:chrome:2.0.172.37:::::::*
cpe:2.3:a:google:chrome:2.0.172.38:::::::*
cpe:2.3:a:google:chrome:3.0.182.2:::::::*
cpe:2.3:a:google:chrome:3.0.190.2:::::::*
cpe:2.3:a:google:chrome:3.0.193.2:beta::::::
cpe:2.3:a:google:chrome::::::::		3.0.195.21