CVE-2011-0199

Опубликовано: 24 июн. 2011

Источник: nvd

CVSS3: 5.9

CVSS2: 5.8

EPSS Низкий

Описание

The Certificate Trust Policy component in Apple Mac OS X before 10.6.8 does not perform CRL checking for Extended Validation (EV) certificates that lack OCSP URLs, which might allow man-in-the-middle attackers to spoof an SSL server via a revoked certificate.

Ссылки

http://lists.apple.com/archives/security-announce/2011//Jun/msg00000.html
Mailing List
Patch
Vendor Advisory
http://support.apple.com/kb/HT4723
Patch
Vendor Advisory
http://www.securityfocus.com/bid/48447
Broken Link
Third Party Advisory
VDB Entry
http://lists.apple.com/archives/security-announce/2011//Jun/msg00000.html
Mailing List
Patch
Vendor Advisory
http://support.apple.com/kb/HT4723
Patch
Vendor Advisory
http://www.securityfocus.com/bid/48447
Broken Link
Third Party Advisory
VDB Entry

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*

Версия от 10.6.0 (включая) до 10.6.8 (исключая)

cpe:2.3:o:apple:mac_os_x_server:*:*:*:*:*:*:*:*

Версия от 10.6.0 (включая) до 10.6.8 (исключая)

EPSS

Процентиль: 39%

0.00173

Низкий

5.9 Medium

CVSS3

5.8 Medium

CVSS2

Дефекты

CWE-295

Связанные уязвимости

GHSA-c9fj-rcg9-g5cf