NVD

Id
25564  
Name
CVE-2015-3996  
Description
The default AFSecurityPolicy.validatesDomainName configuration for AFSSLPinningModeNone in the AFNetworking framework before 2.5.3, as used in the ownCloud iOS Library, disables verification of a server hostname against the domain name in the subject"s Common Name (CN) of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.  
Reject
 
CVSS Version
2  
CVSS Score
4.3  
Severity
Medium  
CVSS Base Score
4.3  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:N/I:P/A:N)  
Pub Date
2017-01-19  
Published
2015-10-27  
Modified Date
2015-10-28  
Seq
2015-3996  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
135022 25564 CVE-2015-3996 76242  View
135023 25564 CVE-2015-3996 https://github.com/AFNetworking/AFNetworking/issues/2619  View
135024 25564 CVE-2015-3996 https://github.com/AFNetworking/AFNetworking/releases/tag/2.5.3  View
135025 25564 CVE-2015-3996 https://owncloud.org/security/advisory/?id=oc-sa-2015-012  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
10302 JVNDB-2015-005622 ownCloud iOS Library で使用される AFNetworking フレームワークにおける SSL サーバになりすまされる脆弱性 ownCloud iOS Library で使用される AFNetworking フレームワークの AFSSLPinningModeNone 用 AFSecurityPolicy.validatesDomainName のデフォルト設定は、X.509 証明書のサブジェクトの Common Name (CN) 内のドメイン名に反するサーバホスト名の検証を無効にするため、SSL サーバになりすまされる脆弱性が存在します。 CVE-2015-3996 81221 CVE-2015-3996 25564 4.3 http://jvndb.jvn.jp/ja/contents/2015/JVNDB-2015-005622.html 2015-04-20 2015-10-29 View