Apple · Libsecurity · CVE-2010-1802
**Name of the Vulnerable Software and Affected Versions**
libsecurity in Apple Mac OS X versions 10.5.8 through 10.6.4
**Description**
The issue allows man-in-the-middle attackers to spoof SSL servers via a certificate associated with a similar domain name. This can be demonstrated by using a certificate for a similar domain name to spoof the actual domain, such as using a www.example.con certificate to spoof www.example.com.
**Recommendations**
For Apple Mac OS X versions 10.5.8 through 10.6.4, consider updating to a newer version that properly performs comparisons to domain-name strings in X.509 certificates to prevent man-in-the-middle attacks. As a temporary workaround, restrict access to sensitive information over SSL connections until a patch is available.