CVE-2009-3639
The mod_tls module in ProFTPD before 1.3.2b, and 1.3.3 before 1.3.3rc2, when the dNSNameRequired...
CVE-2009-3639 is a medium vulnerability (CVSS 5.8) in Proftpd, published October 28, 2009. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 5.70%, the 93rd percentile. Fixed in proftpd-dfsg 1.3.2a-2.
- Severity
- 5.8 MediumCVSS 2.0, NVD
- Exploit chance
- 5.70%EPSS, 93rd percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
1.3.2a-2proftpd-dfsg +5 more
Description
The mod_tls module in ProFTPD before 1.3.2b, and 1.3.3 before 1.3.3rc2, when the dNSNameRequired TLS option is enabled, does not properly handle a '\0' character in a domain name in the Subject Alternative Name field of an X.509 client certificate, which allows remote attackers to bypass intended client-hostname restrictions via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
proftpd-dfsgDebian:12 | before 1.3.2a-2 | 1.3.2a-2 |
proftpd-dfsgDebian:13 | before 1.3.2a-2 | 1.3.2a-2 |
proftpd-dfsgDebian:14 | before 1.3.2a-2 | 1.3.2a-2 |
proftpd-dfsgDebian:4.0 | before 1.3.0-19etch3, plus listed versions 1.3.0-191.3.0-19etch11.3.0-19etch2 | 1.3.0-19etch3 |
proftpd-dfsgDebian:5.0 | before 1.3.1-17lenny4, plus listed versions 1.3.1-161.3.1-171.3.1-17lenny11.3.1-17lenny21.3.1-17lenny2~bpo40+11.3.1-17lenny31.3.1-17lenny4~bpo40+1 | 1.3.1-17lenny4 |
proftpdopenSUSE:Tumbleweed From an advisory covering 8 CVEs | before 1.3.5b-2.5 | 1.3.5b-2.5 |
What each source reports
NVD Score used
The mod_tls module in ProFTPD before 1.3.2b, and 1.3.3 before 1.3.3rc2, when the dNSNameRequired TLS option is enabled, does not properly handle a '\0' character in a domain name in the Subject Alternative Name field of an X.509 client certificate, which allows remote attackers to bypass intended client-hostname restrictions via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.
- Record
CVE-2009-3639- CVSS 2.0
- 5.8 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:P - Weakness
- CWE-310
- Updated
- 2026-11-02
CVE ListNo score
The mod_tls module in ProFTPD before 1.3.2b, and 1.3.3 before 1.3.3rc2, when the dNSNameRequired TLS option is enabled, does not properly handle a '\0' character in a domain name in the Subject Alternative Name field of an X.509 client certificate, which allows remote attackers to bypass intended client-hostname restrictions via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.
- Record
CVE-2009-3639- Updated
- 2026-11-02
EUVDEUVD-2009-3614No score
The mod_tls module in ProFTPD before 1.3.2b, and 1.3.3 before 1.3.3rc2, when the dNSNameRequired TLS option is enabled, does not properly handle a '\0' character in a domain name in the Subject Alternative Name field of an X.509 client certificate, which allows remote attackers to bypass intended client-hostname restrictions via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.
- Record
EUVD-2009-3614- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-4vq9-9g4j-pgg4No score
The mod_tls module in ProFTPD before 1.3.2b, and 1.3.3 before 1.3.3rc2, when the dNSNameRequired...
The mod_tls module in ProFTPD before 1.3.2b, and 1.3.3 before 1.3.3rc2, when the dNSNameRequired TLS option is enabled, does not properly handle a '\0' character in a domain name in the Subject Alternative Name field of an X.509 client certificate, which allows remote attackers to bypass intended client-hostname restrictions via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.
- Record
GHSA-4vq9-9g4j-pgg4- Updated
- 2026-11-02
OSVNo score
The mod_tls module in ProFTPD before 1.3.2b, and 1.3.3 before 1.3.3rc2, when the dNSNameRequired TLS option is enabled, does not properly handle a '\0' character in a domain name in the Subject Alternative Name field of an X.509 client certificate, which allows remote attackers to bypass intended client-hostname restrictions via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.
- Record
CVE-2009-3639- Updated
- 2026-11-02
OSVDEBIAN-CVE-2009-3639No score
The mod_tls module in ProFTPD before 1.3.2b, and 1.3.3 before 1.3.3rc2, when the dNSNameRequired TLS option is enabled, does not properly handle a '\0' character in a domain name in the Subject Alternative Name field of an X.509 client certificate, which allows remote attackers to bypass intended client-hostname restrictions via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.
- Record
DEBIAN-CVE-2009-3639- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10048-1No score
proftpd-1.3.5b-2.5 on GA media
These are all security issues fixed in the proftpd-1.3.5b-2.5 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10048-1- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
marc.info?l=oss-security&m=125630966510672&w=2
redhat.com/archives/fedora-package-announce/2009-November/msg00649.html
secunia.com/advisories/37219
debian.org/security/2009/dsa-1925
bugs.proftpd.org/show_bug.cgi?id=3275
Show 17 moreShow less
securityfocus.com/bid/36804
exchange.xforce.ibmcloud.com/vulnerabilities/53936
mandriva.com/security/advisories?name=MDVSA-2009:288
bugzilla.redhat.com/show_bug.cgi?id=530719
nvd.nist.gov/vuln/detail/CVE-2009-3639
github.com/advisories/GHSA-4vq9-9g4j-pgg4
security-tracker.debian.org/tracker/CVE-2009-3639
suse.com/security/cve/CVE-2009-0542