NVD

Id
8070  
Name
CVE-2011-1094  
Description
kio/kio/tcpslavebase.cpp in KDE KSSL in kdelibs before 4.6.1 does not properly verify that the server hostname matches the domain name of the subject of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a certificate issued by a legitimate Certification Authority for an IP address, a different vulnerability than CVE-2009-2702.  
Reject
 
CVSS Version
2  
CVSS Score
4.3  
Severity
Medium  
CVSS Base Score
4.3  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:N/I:P/A:N)  
Pub Date
2017-01-07  
Published
2011-03-16  
Modified Date
2011-04-20  
Seq
2011-1094  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
46031 8070 CVE-2011-1094 [oss-security] 20110308 KDE SSL name check issue  View
46032 8070 CVE-2011-1094 [oss-security] 20110308 Re: KDE SSL name check issue  View
46033 8070 CVE-2011-1094 MDVSA-2011:071  View
46034 8070 CVE-2011-1094 46789  View
46035 8070 CVE-2011-1094 USN-1110-1  View
46036 8070 CVE-2011-1094 ADV-2011-0913  View
46037 8070 CVE-2011-1094 ADV-2011-0990  View
46038 8070 CVE-2011-1094 kdelibs-ssl-security-bypass(65986)  View
46039 8070 CVE-2011-1094 https://projects.kde.org/projects/kde/kdelibs/repository/revisions/76f935197599a335a5fe09b78751ddb455248cf7  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
31355 JVNDB-2011-001595 kdelibs の kio/kio/tcpslavebase.cpp における任意の SSL サーバになりすまされる脆弱性 kdelibs の KDE KSSL 内にある kio/kio/tcpslavebase.cpp は、X.509 証明書のドメイン名とサーバのホスト名が一致するか適切に検証しないため、任意の SSL サーバになりすまされる脆弱性が存在します。 CVE-2011-1094 49001 CVE-2011-1094 8070 4.3 http://jvndb.jvn.jp/ja/contents/2011/JVNDB-2011-001595.html 2011-04-21 2011-05-18 View