PT-2010-2485 · Microsoft · Amsn

Gabriel Menezes Nunes

·

Publicado

2010-04-20

·

Atualizado

2010-05-14

·

CVE-2010-0744

CVSS v2.0

5.8

Média

VetorAV:N/AC:M/Au:N/C:P/I:P/A:N
Name of the Vulnerable Software and Affected Versions aMSN versions 0.98.3 and earlier
Description The issue allows man-in-the-middle attackers to spoof an MSN server via an arbitrary certificate when SSL is used, because the software does not verify that the server hostname matches a domain name in the subject's Common Name (CN) field or a Subject Alternative Name field of the X.509 certificate.
Recommendations For versions 0.98.3 and earlier, update to a version that verifies the server hostname matches a domain name in the subject's Common Name (CN) field or a Subject Alternative Name field of the X.509 certificate to prevent man-in-the-middle attacks.

Correção

Improper Authentication

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2010-0744

Produtos afetados

Amsn