PT-2013-5389 · Apple · Os X Server

Arek Dreyer · Published 2013-10-24 · Updated 2013-10-24 · CVE-2013-5143

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Apple OS X Server versions prior to 3.0

Description The issue concerns the RADIUS service in Server App, where it selects a fallback X.509 certificate under certain circumstances. This could potentially allow man-in-the-middle attackers to hijack RADIUS sessions if they have knowledge of the private key matching the fallback certificate.

Recommendations For Apple OS X Server versions prior to 3.0, update to version 3.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the RADIUS service until the update can be applied.

Fix

Related Identifiers

CVE-2013-5143

Affected Products

Os X Server

References · 2

• http://lists.apple.com/archives/security-announce/2013/Oct/msg00006.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-5143 · Security Note