CVE:CVE-2009-3941
CNNVD:CNNVD-200911-164
当OpenSSL被使用时，Martin Lambers mpop 1.0.19之前版本没有在X.509证书的(1)对象的一般名称或(2)对象的替代名称中的域名中正确的处理'\0'字符，这使得中间人攻击者可以借助一个特制的由合法的证书颁发机构颁发的证书，欺骗任意的SSL服务器。此漏洞与CVE-2009-2408有关。
solution:Upgrade martin_lambers mpop to a higher version than 1.0.18,0.1.0,0.1.1,0.1.2,0.1.3,0.1.4,0.2.0,0.3.0,0.3.1,0.4.0,0.4.1,0.4.2,0.4.3,0.5.0,0.6.0,0.6.1,0.6.2,0.6.3,0.7.0,0.8.0,0.8.1,0.8.2,0.8.3,0.8.4,0.8.5,1.0.0,1.0.1,1.0.2,1.0.3,1.0.4,1.0.5,1.0.6,1.0.8,1.0.9,1.0.10,1.0.11,1.0.12,1.0.13,1.0.14,1.0.15,1.0.16,1.0.17,and avoid the version (,1.0.18],0.1.0,0.1.1,0.1.2,0.1.3,0.1.4,0.2.0,0.3.0,0.3.1,0.4.0,0.4.1,0.4.2,0.4.3,0.5.0,0.6.0,0.6.1,0.6.2,0.6.3,0.7.0,0.8.0,0.8.1,0.8.2,0.8.3,0.8.4,0.8.5,1.0.0,1.0.1,1.0.2,1.0.3,1.0.4,1.0.5,1.0.6,1.0.8,1.0.9,1.0.10,1.0.11,1.0.12,1.0.13,1.0.14,1.0.15,1.0.16,1.0.17