724
The following OpenSSL code obtains a certificate and verifies it.
Example Language: C (Bad)
cert = SSL_get_peer_certificate(ssl);
if (cert && (SSL_get_verify_result(ssl)==X509_V_OK)) {
// do secret things
}
Even though the "verify" step returns X509_V_OK, this step does not include checking the
Common Name against the name of the host. That is, there is no guarantee that the certificate is
for the desired host. The SSL connection could have been established with a malicious host that
provided a valid certificate.
Observed Examples
Reference Description
CVE-2012-5810 Mobile banking application does not verify hostname, leading to financial loss.
https://www.cve.org/CVERecord?id=CVE-2012-5810
CVE-2012-5811 Mobile application for printing documents does not verify hostname, allowing
attackers to read sensitive documents.
https://www.cve.org/CVERecord?id=CVE-2012-5811
CVE-2012-5807 Software for electronic checking does not verify hostname, leading to financial
loss.
https://www.cve.org/CVERecord?id=CVE-2012-5807
CVE-2012-3446 Cloud-support library written in Python uses incorrect regular expression when
matching hostname.
https://www.cve.org/CVERecord?id=CVE-2012-3446
CVE-2009-2408 Web browser does not correctly handle '\0' character (NUL) in Common Name,
allowing spoofing of https sites.
https://www.cve.org/CVERecord?id=CVE-2009-2408
CVE-2012-0867 Database program truncates the Common Name during hostname verification,
allowing spoofing.
https://www.cve.org/CVERecord?id=CVE-2012-0867
CVE-2010-2074 Incorrect handling of '\0' character (NUL) in hostname verification allows
spoofing.
https://www.cve.org/CVERecord?id=CVE-2010-2074
CVE-2009-4565 Mail server's incorrect handling of '\0' character (NUL) in hostname verification
allows spoofing.
https://www.cve.org/CVERecord?id=CVE-2009-4565
CVE-2009-3767 LDAP server's incorrect handling of '\0' character (NUL) in hostname
verification allows spoofing.
https://www.cve.org/CVERecord?id=CVE-2009-3767
CVE-2012-5806 Payment processing module does not verify hostname when connecting to
PayPal using PHP fsockopen function.
https://www.cve.org/CVERecord?id=CVE-2012-5806
CVE-2012-2993 Smartphone device does not verify hostname, allowing spoofing of mail
services.
https://www.cve.org/CVERecord?id=CVE-2012-2993
CVE-2012-5804 E-commerce module does not verify hostname when connecting to payment
site.
https://www.cve.org/CVERecord?id=CVE-2012-5804
CVE-2012-5824 Chat application does not validate hostname, leading to loss of privacy.
https://www.cve.org/CVERecord?id=CVE-2012-5824
CVE-2012-5822 Application uses third-party library that does not validate hostname.
https://www.cve.org/CVERecord?id=CVE-2012-5822
CVE-2012-5819 Cloud storage management application does not validate hostname.
CWE Version 4.14
CWE-297: Improper Validation of Certificate with Host Mismatch
CWE-297: Improper Validation of Certificate with Host Mismatch