PT-2012-6093

CVE-2012-5781

·

Publicado

2012-11-04

·

Atualizado

2021-05-10

Descrição por

CVSS 2.0
5.8
Média
MétricasAV:N/AC:M/Au:N/C:P/I:P/A:N
Name of the Vulnerable Software and Affected Versions Amazon Elastic Load Balancing API Tools (affected versions not specified)
Description The issue concerns a failure to verify the server hostname against the domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate. This allows man-in-the-middle attackers to spoof SSL servers using any valid certificate, by overriding the default JDK X509TrustManager.
Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Explorabilidade
Exploit
Impactos
Fornecedores
Produtos afetados
Enumeração de fraquezas
CWE-20: Improper Input Validation
Identificadores relacionados
CVE-2012-5781
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com