PT-2011-2599 · Globus · Myproxy+1

Published 2011-02-02 · Updated 2017-08-17 · CVE-2011-0738

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions MyProxy versions 5.0 through 5.2 Globus Toolkit versions 5.0.0 through 5.0.2

Description The issue allows remote attackers to conduct man-in-the-middle (MITM) attacks by spoofing the server, due to improper verification of the hostname or identity in the X.509 certificate for the myproxy-server. This can occur when executing commands such as myproxy-logon or myproxy-get-delegation with a crafted certificate.

Recommendations For MyProxy versions 5.0 through 5.2, update the software to properly verify the hostname and identity in the X.509 certificate. For Globus Toolkit versions 5.0.0 through 5.0.2, ensure that the underlying MyProxy component is updated to address the issue.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2011-0738

Affected Products

Globus Toolkit

Myproxy

References · 11

• http://secunia.com/advisories/42972 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2011-January/053461.html · Vendor Advisory
• http://secunia.com/advisories/43103 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2011-0738 · Security Note
• http://lists.globus.org/pipermail/security-announce/2011-January/000018.html · Patch
• http://lists.fedoraproject.org/pipermail/package-announce/2011-January/053473.html · Vendor Advisory
• http://grid.ncsa.illinois.edu/myproxy/security/myproxy-adv-2011-01.txt · Vendor Advisory
• http://vupen.com/english/advisories/2011/0227 · Note
• http://osvdb.org/70494 · Note
• http://securityfocus.com/bid/45916 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/64830 · Note