PT-2012-2219 · Tmhoauth · Tmhoauth

Published 2012-11-06 · Updated 2012-11-06 · CVE-2011-5242

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions tmhOAuth versions prior to 0.61

Description The issue allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate because it does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate.

Recommendations For versions prior to 0.61, update to version 0.61 or later to resolve the issue. As a temporary workaround, consider verifying the server hostname manually to ensure it matches the domain name in the certificate. Restrict access to sensitive operations until the update is applied to minimize the risk of exploitation.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2011-5242

Affected Products

Tmhoauth

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2011-5242 · Security Note
• https://github.com/themattharris/tmhOAuth/blob/master/README.md · Note
• http://unrest.ca/peerjacking · Note