PT-2014-2351 · Ibm · X3270

Florian Weimer · Publicado 2014-05-27 · Atualizado 2017-08-29 · CVE-2012-5662

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions x3270 versions prior to 3.3.12ga12

Description The issue allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate because it does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate.

Recommendations For versions prior to 3.3.12ga12, update to version 3.3.12ga12 or later to resolve the issue.

Correção

Enumeração de Fraquezas

CWE-310

Identificadores relacionados

CVE-2012-5662

Produtos afetados

X3270

Referências · 13

• https://ubuntu.com/security/CVE-2012-5662 · Aviso do Fabricante
• http://sourceforge.net/projects/x3270/files/x3270/3.3.12ga12 · Nota
• https://cve.org/CVERecord?id=CVE-2012-5662 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2012-5662 · Nota de Segurança
• http://osvdb.org/91572 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2012-5662 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2013/03/21 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/82984 · Nota
• https://osv.dev/vulnerability/CVE-2012-5662 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2012-5662 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2012-5662 · Aviso do Fabricante
• https://bugzilla.redhat.com/show_bug.cgi?id=889373 · Nota
• http://secunia.com/advisories/52650 · Nota