PT-2006-5212 · Apple · Macos X

Timothy J. Miller · Published 2006-11-30 · Updated 2011-03-08 · CVE-2006-4409

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Mac OS X versions 10.4 through 10.4.8

Description The issue concerns the Online Certificate Status Protocol (OCSP) service in the Security Framework, which retrieves certificate revocation lists (CRL) when an HTTP proxy is in use. This could lead to the system accepting certificates that have been revoked.

Recommendations For Mac OS X versions 10.4 through 10.4.8, consider disabling the use of HTTP proxies for OCSP services until a fix is available. Restrict access to the OCSP service to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2006-4409

Affected Products

Macos X

References · 10

• http://secunia.com/advisories/23155 · Vendor Advisory
• http://lists.apple.com/archives/security-announce/2006/Nov/msg00001.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-4409 · Security Note
• http://docs.info.apple.com/article.html?artnum=304829 · Note
• http://osvdb.org/30729 · Note
• http://kb.cert.org/vuls/id/811384 · Note
• http://us-cert.gov/cas/techalerts/TA06-333A.html · Note
• http://securitytracker.com/id?1017298 · Note
• http://vupen.com/english/advisories/2006/4750 · Note
• http://securityfocus.com/bid/21335 · Note