PT-2010-3435 · Apple · Libsecurity+1

Peter Speck · Published 2010-08-25 · Updated 2010-08-26 · CVE-2010-1802

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions libsecurity in Apple Mac OS X versions 10.5.8 through 10.6.4

Description The issue allows man-in-the-middle attackers to spoof SSL servers via a certificate associated with a similar domain name. This can be demonstrated by using a certificate for a similar domain name to spoof the actual domain, such as using a www.example.con certificate to spoof www.example.com.

Recommendations For Apple Mac OS X versions 10.5.8 through 10.6.4, consider updating to a newer version that properly performs comparisons to domain-name strings in X.509 certificates to prevent man-in-the-middle attacks. As a temporary workaround, restrict access to sensitive information over SSL connections until a patch is available.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2010-1802

Affected Products

Macos X

Libsecurity

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2010-1802 · Security Note
• http://lists.apple.com/archives/security-announce/2010//Aug/msg00003.html · Vendor Advisory
• http://support.apple.com/kb/HT4312 · Vendor Advisory
• http://securitytracker.com/id?1024359 · Note