PT-2014-2351 · Ibm · X3270

Florian Weimer · Published 2014-05-27 · Updated 2017-08-29 · CVE-2012-5662

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions x3270 versions prior to 3.3.12ga12

Description The issue allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate because it does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate.

Recommendations For versions prior to 3.3.12ga12, update to version 3.3.12ga12 or later to resolve the issue.

Fix

Weakness Enumeration

CWE-310

Related Identifiers

CVE-2012-5662

Affected Products

X3270

References · 13

• https://ubuntu.com/security/CVE-2012-5662 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2012-5662 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2012-5662 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2012-5662 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2012-5662 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2012-5662 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2012-5662 · Vendor Advisory
• http://sourceforge.net/projects/x3270/files/x3270/3.3.12ga12 · Note
• http://osvdb.org/91572 · Note
• http://openwall.com/lists/oss-security/2013/03/21 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/82984 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=889373 · Note
• http://secunia.com/advisories/52650 · Note