NVD

Id
10066  
Name
CVE-2011-3422  
Description
The Keychain implementation in Apple Mac OS X 10.6.8 and earlier does not properly handle an untrusted attribute of a Certification Authority certificate, which makes it easier for man-in-the-middle attackers to spoof arbitrary SSL servers via an Extended Validation certificate, as demonstrated by https access with Safari.  
Reject
 
CVSS Version
2  
CVSS Score
4.3  
Severity
Medium  
CVSS Base Score
4.3  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:N/I:P/A:N)  
Pub Date
2017-01-07  
Published
2011-09-12  
Modified Date
2012-02-03  
Seq
2011-3422  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
57743 10066 CVE-2011-3422 APPLE-SA-2012-02-01-1  View
57744 10066 CVE-2011-3422 http://support.apple.com/kb/HT5130  View
57745 10066 CVE-2011-3422 http://www.computerworld.com/s/article/9219669/Mac_OS_X_can_t_properly_revoke_dodgy_digital_certificates  View
57746 10066 CVE-2011-3422 49429  View
57747 10066 CVE-2011-3422 1026002  View
57748 10066 CVE-2011-3422 macos-keychain-sec-bypass(69556)  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
34649 JVNDB-2011-004891 Apple Mac OS X の Keychain の実装における任意の SSL サーバになりすまされる脆弱性 Apple Mac OS X の Keychain の実装は、正規認証局の証明書の信頼しない属性を適切に処理しないため、SSL サーバになりすまされる脆弱性が存在します。 CVE-2011-3422 51329 CVE-2011-3422 10066 4.3 http://jvndb.jvn.jp/ja/contents/2011/JVNDB-2011-004891.html 2011-09-12 2012-03-27 View