CVE-2012-5824

 

Published at: - 04-11-2012 11:55

Last modified: - 07-02-2022 07:59

Total changes: - 2

Description

Trillian 5.1.0.19 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate, a different vulnerability than CVE-2009-4831.

Common Vulnerability Scoring System (CVSS)

AV:N/AC:M/Au:N/C:P/I:P/A:N

 

Verification logic

 

Reference

• http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf
• 56454-Broken Link, Third Party Advisory, VDB Entry
• 51190-Broken Link
• trillian-ssl-spoofing(79915)-Third Party Advisory, VDB Entry

 

Keywords

NVD

 

CVE-2012-5824

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures