PT-2006-5210 · Apple · Macos X

Eric Cronin · Published 2006-11-30 · Updated 2011-03-08 · CVE-2006-4407

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apple Mac OS X versions 10.3.x up to 10.3.9

Description The issue is related to the Security Framework in Apple Mac OS X, which does not properly prioritize encryption ciphers. This causes Secure Transport to use a weaker cipher when negotiating the strongest shared cipher, making it easier for remote attackers to decrypt traffic.

Recommendations For Apple Mac OS X versions 10.3.x up to 10.3.9, update to a version that properly prioritizes encryption ciphers to prevent the use of weaker ciphers.

Fix

Related Identifiers

CVE-2006-4407

Affected Products

Macos X

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2006-4407 · Security Note
• http://secunia.com/advisories/23155 · Vendor Advisory
• http://lists.apple.com/archives/security-announce/2006/Nov/msg00001.html · Vendor Advisory
• http://osvdb.org/30731 · Note
• http://docs.info.apple.com/article.html?artnum=304829 · Note
• http://kb.cert.org/vuls/id/734032 · Note
• http://us-cert.gov/cas/techalerts/TA06-333A.html · Note
• http://securitytracker.com/id?1017298 · Note
• http://vupen.com/english/advisories/2006/4750 · Note
• http://securityfocus.com/bid/21335 · Note