PT-2006-5212 · Apple · Macos X

Timothy J. Miller · Publicado 2006-11-30 · Atualizado 2011-03-08 · CVE-2006-4409

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Mac OS X versions 10.4 through 10.4.8

Description The issue concerns the Online Certificate Status Protocol (OCSP) service in the Security Framework, which retrieves certificate revocation lists (CRL) when an HTTP proxy is in use. This could lead to the system accepting certificates that have been revoked.

Recommendations For Mac OS X versions 10.4 through 10.4.8, consider disabling the use of HTTP proxies for OCSP services until a fix is available. Restrict access to the OCSP service to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2006-4409

Produtos afetados

Macos X

Referências · 10

• http://docs.info.apple.com/article.html?artnum=304829 · Nota
• http://secunia.com/advisories/23155 · Aviso do Fabricante
• http://lists.apple.com/archives/security-announce/2006/Nov/msg00001.html · Aviso do Fabricante
• http://osvdb.org/30729 · Nota
• http://kb.cert.org/vuls/id/811384 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-4409 · Nota de Segurança
• http://us-cert.gov/cas/techalerts/TA06-333A.html · Nota
• http://securitytracker.com/id?1017298 · Nota
• http://vupen.com/english/advisories/2006/4750 · Nota
• http://securityfocus.com/bid/21335 · Nota