What is CVE-2009-0127?

CVE-2009-0127 is a vulnerability in Heikkitoivonen M2crypto, classified under Improper Authentication. Published 2009-01-15.

Is CVE-2009-0127 known to be exploited?

2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Auth bypass in Heikkitoivonen M2crypto

CVE-2009-0127

M2Crypto does not properly check the return value from the OpenSSL EVP_VerifyFinal, DSA_verify, ECDSA_verify, DSA_do_verify, and ECDSA_do_verify functions, which might allow remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature, a similar vulnerability to CVE-2008-5077. NOTE: a Linux vendor disputes the relevance of this report to the M2Crypto product because "these functions are not used anywhere in m2crypto.

Vulnerability class: Broken Authentication

EPSS: 0.014 (69.3th percentile) — read the EPSS interpretation.

Affected products

Heikkitoivonen M2crypto
N/a — versions n/a

Weakness classification (CWE)

CWE-287 — Improper Authentication

Public proof-of-concept exploits

References

cve@mitre.org (Exploit, x_refsource_MISC, Issue Tracking)
cve@mitre.org (mailing-list, x_refsource_MLIST, Mailing List)
cve@mitre.org (Third Party Advisory, x_refsource_MISC)

Frequently asked questions

What is CVE-2009-0127?: CVE-2009-0127 is a vulnerability in Heikkitoivonen M2crypto, classified under Improper Authentication. Published 2009-01-15.
Is CVE-2009-0127 known to be exploited?: 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.