PT-2010-2485 · Microsoft · Amsn

Gabriel Menezes Nunes · Published 2010-04-20 · Updated 2010-05-14 · CVE-2010-0744

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions aMSN versions 0.98.3 and earlier

Description The issue allows man-in-the-middle attackers to spoof an MSN server via an arbitrary certificate when SSL is used, because the software does not verify that the server hostname matches a domain name in the subject's Common Name (CN) field or a Subject Alternative Name field of the X.509 certificate.

Recommendations For versions 0.98.3 and earlier, update to a version that verifies the server hostname matches a domain name in the subject's Common Name (CN) field or a Subject Alternative Name field of the X.509 certificate to prevent man-in-the-middle attacks.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2010-0744

Affected Products

Amsn

References · 16

• http://amsn.svn.sourceforge.net/viewvc/amsn/trunk/?view=log&pathrev=11991 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2010-May/041079.html · Vendor Advisory
• http://amsn.svn.sourceforge.net/viewvc/amsn/trunk/amsn/soap.tcl?r1=11891&r2=11991&pathrev=11991 · Vendor Advisory
• http://amsn.svn.sourceforge.net/viewvc/amsn/trunk/amsn/proxy.tcl?r1=11886&r2=11991&pathrev=11991 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2010-May/041046.html · Vendor Advisory
• http://amsn.svn.sourceforge.net/viewvc/amsn/trunk/amsn/sip.tcl?r1=11953&r2=11991&pathrev=11991 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-0744 · Security Note
• http://secunia.com/advisories/35621 · Vendor Advisory
• http://opensource-archive.org/showthread.php?p=183821 · Note
• http://openwall.com/lists/oss-security/2010/03/10/4 · Note
• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=572818 · Note
• http://openwall.com/lists/oss-security/2010/04/01/4 · Note
• http://vupen.com/english/advisories/2010/1109 · Note
• http://secunia.com/advisories/39796 · Note
• http://securityfocus.com/bid/35507 · Note