Unscored CVE-2009-0051 EUVD-2009-0060GHSA-7wm2-j7jq-4xvr

ZXID 0.29 and earlier does not properly check the return value from the OpenSSL DSA_verify function, which allows remote attackers to bypas…

Published Jan 7, 2009 · Updated Aug 7, 2024 · Assigned by mitre

Description

ZXID 0.29 and earlier does not properly check the return value from the OpenSSL DSA_verify function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature, a similar vulnerability to CVE-2008-5077.

References

openssl-dsa-verify-security-bypass(47837) vdb-entry
20090107 [oCERT-2008-016] Multiple OpenSSL signature verification API misuses mailing-list
http://www.ocert.org/advisories/ocert-2008-016.html