CVE-2011-0738

Summary

MyProxy 5.0 through 5.2, as used in Globus Toolkit 5.0.0 through 5.0.2, does not properly verify the (1) hostname or (2) identity in the X.509 certificate for the myproxy-server, which allows remote attackers to spoof the server and conduct man-in-the-middle (MITM) attacks via a crafted certificate when executing (a) myproxy-logon or (b) myproxy-get-delegation.

Affected Software

Weaknesses

• n/a

ADP Enrichment

CVE Program Container

Additional References

• http://lists.fedoraproject.org/pipermail/package-announce/2011-January/053461.html
• http://www.vupen.com/english/advisories/2011/0227
• http://lists.globus.org/pipermail/security-announce/2011-January/000018.html
• http://secunia.com/advisories/43103
• https://exchange.xforce.ibmcloud.com/vulnerabilities/64830
• http://lists.fedoraproject.org/pipermail/package-announce/2011-January/053473.html
• http://grid.ncsa.illinois.edu/myproxy/security/myproxy-adv-2011-01.txt
• http://www.securityfocus.com/bid/45916
• http://osvdb.org/70494
• http://secunia.com/advisories/42972

References

• http://lists.fedoraproject.org/pipermail/package-announce/2011-January/053461.html
• http://www.vupen.com/english/advisories/2011/0227
• http://lists.globus.org/pipermail/security-announce/2011-January/000018.html
• http://secunia.com/advisories/43103
• https://exchange.xforce.ibmcloud.com/vulnerabilities/64830
• http://lists.fedoraproject.org/pipermail/package-announce/2011-January/053473.html
• http://grid.ncsa.illinois.edu/myproxy/security/myproxy-adv-2011-01.txt
• http://www.securityfocus.com/bid/45916
• http://osvdb.org/70494
• http://secunia.com/advisories/42972

• ←Previous
• Next→