NVD

Id
36640  
Name
CVE-2013-0289  
Description
Isync 0.4 before 1.0.6, does not verify that the server hostname matches a domain name in the subject"s Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.  
Reject
 
CVSS Version
2  
CVSS Score
4.3  
Severity
Medium  
CVSS Base Score
4.3  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:P/I:N/A:N)  
Pub Date
2017-01-18  
Published
2014-05-23  
Modified Date
2014-06-27  
Seq
2013-0289  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
187267 36640 CVE-2013-0289 FEDORA-2013-2795  View
187268 36640 CVE-2013-0289 FEDORA-2013-2758  View
187269 36640 CVE-2013-0289 GLSA-201310-02  View
187270 36640 CVE-2013-0289 http://sourceforge.net/p/isync/isync/ci/914ede18664980925628a9ed2a73ad05f85aeedb  View
187271 36640 CVE-2013-0289 http://sourceforge.net/projects/isync/files/isync/1.0.6/  View
187272 36640 CVE-2013-0289 [oss-security] 20130220 isync/mbsync security advisory: missing SSL subject verification (CVE-2013-0289)  View
187273 36640 CVE-2013-0289 57423  View
187274 36640 CVE-2013-0289 isync-ssl-info-disc(82232)  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
24921 JVNDB-2013-006496 Isync における SSL サーバになりすまされる脆弱性 Isync は、X.509 証明書のサブジェクトの Common Name (CN) または SubjectAltName フィールド内のドメイン名とサーバのホスト名が一致することを検証しないため、SSL サーバになりすまされる脆弱性が存在します。 CVE-2013-0289 60231 CVE-2013-0289 36640 4.3 http://jvndb.jvn.jp/ja/contents/2013/JVNDB-2013-006496.html 2013-02-03 2014-05-28 View