PT-2011-2599 · Globus · Myproxy+1

Publicado 2011-02-02 · Atualizado 2017-08-17 · CVE-2011-0738

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions MyProxy versions 5.0 through 5.2 Globus Toolkit versions 5.0.0 through 5.0.2

Description The issue allows remote attackers to conduct man-in-the-middle (MITM) attacks by spoofing the server, due to improper verification of the hostname or identity in the X.509 certificate for the myproxy-server. This can occur when executing commands such as myproxy-logon or myproxy-get-delegation with a crafted certificate.

Recommendations For MyProxy versions 5.0 through 5.2, update the software to properly verify the hostname and identity in the X.509 certificate. For Globus Toolkit versions 5.0.0 through 5.0.2, ensure that the underlying MyProxy component is updated to address the issue.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2011-0738

Produtos afetados

Globus Toolkit

Myproxy

Referências · 11

• http://secunia.com/advisories/42972 · Aviso do Fabricante
• http://vupen.com/english/advisories/2011/0227 · Nota
• http://osvdb.org/70494 · Nota
• http://lists.fedoraproject.org/pipermail/package-announce/2011-January/053461.html · Aviso do Fabricante
• http://securityfocus.com/bid/45916 · Nota
• http://secunia.com/advisories/43103 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2011-0738 · Nota de Segurança
• http://lists.globus.org/pipermail/security-announce/2011-January/000018.html · Correção
• https://exchange.xforce.ibmcloud.com/vulnerabilities/64830 · Nota
• http://lists.fedoraproject.org/pipermail/package-announce/2011-January/053473.html · Aviso do Fabricante
• http://grid.ncsa.illinois.edu/myproxy/security/myproxy-adv-2011-01.txt · Aviso do Fabricante