CVE-2009-3639

CVE-2009-3639 describes a vulnerability in the mod_tls module of ProFTPD versions prior to 1.3.2b and 1.3.3rc2. When the dNSNameRequired TLS option is enabled, the software fails to properly handle a null character in the Subject Alternative Name field of an X.509 client certificate. This flaw allows remote attackers to bypass client-hostname restrictions using a specially crafted certificate from a legitimate Certification Authority. The vulnerability has a CVSS score of 5.8, indicating a medium severity. It can be exploited remotely with medium attack complexity, potentially leading to partial integrity and availability impacts. There is no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are minimal, with no mentions found, suggesting a low level of public attention. The EPSS score is also very low, indicating a low probability of exploitation.