PT-2015-6380 · Apple · Afnetworking

Published 2015-10-27 · Updated 2015-10-28 · CVE-2015-3996

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions AFNetworking framework versions prior to 2.5.3

Description The issue concerns the default configuration of AFSecurityPolicy.validatesDomainName for AFSSLPinningModeNone in the AFNetworking framework. This configuration disables the verification of a server's hostname against the domain name in the subject's Common Name (CN) of the X.509 certificate. As a result, it allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

Recommendations For AFNetworking framework versions prior to 2.5.3, update to version 2.5.3 or later to enable the verification of a server's hostname against the domain name in the subject's Common Name (CN) of the X.509 certificate.

Fix

Weakness Enumeration

CWE-254

Related Identifiers

CVE-2015-3996

Affected Products

Afnetworking

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2015-3996 · Security Note
• https://owncloud.org/security/advisory/?id=oc-sa-2015-012 · Vendor Advisory
• https://github.com/AFNetworking/AFNetworking/issues/2619 · Note
• https://github.com/AFNetworking/AFNetworking/releases/tag/2.5.3 · Note
• http://securityfocus.com/bid/76242 · Note