Microsoft Windows Phone 7 does not verify the domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof an SSL server for the (1) POP3, (2) IMAP, or (3) SMTP protocol via an arbitrary valid certificate.
References
Link | Resource |
---|---|
http://osvdb.org/85619 | Broken Link |
http://www.kb.cert.org/vuls/id/389795 | Third Party Advisory US Government Resource |
http://www.securityfocus.com/bid/55569 | Broken Link Third Party Advisory VDB Entry |
http://www.securitytracker.com/id?1027541 | Broken Link Third Party Advisory VDB Entry |
https://exchange.xforce.ibmcloud.com/vulnerabilities/78620 | Third Party Advisory VDB Entry |
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: certcc
Published: 2012-09-18T01:00:00
Updated: 2017-08-28T12:57:01
Reserved: 2012-05-30T00:00:00
Link: CVE-2012-2993
JSON object: View
NVD Information
Status : Analyzed
Published: 2012-09-18T03:48:28.507
Modified: 2024-02-14T17:22:38.827
Link: CVE-2012-2993
JSON object: View
Redhat Information
No data.
CWE