PT-2010-3435 · Apple · Libsecurity+1

Peter Speck · Publicado 2010-08-25 · Atualizado 2010-08-26 · CVE-2010-1802

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions libsecurity in Apple Mac OS X versions 10.5.8 through 10.6.4

Description The issue allows man-in-the-middle attackers to spoof SSL servers via a certificate associated with a similar domain name. This can be demonstrated by using a certificate for a similar domain name to spoof the actual domain, such as using a www.example.con certificate to spoof www.example.com.

Recommendations For Apple Mac OS X versions 10.5.8 through 10.6.4, consider updating to a newer version that properly performs comparisons to domain-name strings in X.509 certificates to prevent man-in-the-middle attacks. As a temporary workaround, restrict access to sensitive information over SSL connections until a patch is available.

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2010-1802

Produtos afetados

Macos X

Libsecurity

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2010-1802 · Nota de Segurança
• http://lists.apple.com/archives/security-announce/2010//Aug/msg00003.html · Aviso do Fabricante
• http://securitytracker.com/id?1024359 · Nota
• http://support.apple.com/kb/HT4312 · Aviso do Fabricante