PT-2016-6629 · Intel · Intel Crosswalk

Yakov Shafranovich · Published 2016-08-01 · Updated 2018-10-09 · CVE-2016-5672

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Intel Crosswalk versions prior to 19.49.514.5 Intel Crosswalk versions 20.x prior to 20.50.533.11 Intel Crosswalk versions 21.x prior to 21.51.546.0 Intel Crosswalk versions 22.x prior to 22.51.549.0

Description The issue allows man-in-the-middle attackers to spoof SSL servers and obtain sensitive information via a crafted certificate. This occurs because the software interprets a user's acceptance of one invalid X.509 certificate to mean that all invalid X.509 certificates should be accepted without prompting.

Recommendations For Intel Crosswalk versions prior to 19.49.514.5, update to version 19.49.514.5 or later. For Intel Crosswalk versions 20.x prior to 20.50.533.11, update to version 20.50.533.11 or later. For Intel Crosswalk versions 21.x prior to 21.51.546.0, update to version 21.51.546.0 or later. For Intel Crosswalk versions 22.x prior to 22.51.549.0, update to version 22.51.549.0 or later.

Fix

RCE

Weakness Enumeration

CWE-310

CWE-20

Related Identifiers

CVE-2016-5672

Affected Products

Intel Crosswalk

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2016-5672 · Security Note
• https://lists.crosswalk-project.org/pipermail/crosswalk-help/2016-July/002167.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-5672 · Vendor Advisory
• https://blogs.intel.com/evangelists/2016/07/28/crosswalk-security-vulnerability · Vendor Advisory
• https://wwws.nightwatchcybersecurity.com/2016/07/29/advisory-intel-crosswalk-ssl-prompt-issue · Note
• https://crosswalk-project.org/jira/browse/XWALK-6986 · Note
• http://securityfocus.com/bid/92199 · Note
• http://packetstormsecurity.com/files/138107/Intel-Crosswalk-Project-Man-In-The-Middle.html · Note
• http://securityfocus.com/archive/1/539051/100/0/threaded · Note
• http://kb.cert.org/vuls/id/217871 · Note