CVE-2010-1802: Medium severity apple libsecurity vulnerability

Published Aug 25, 2010

Updated

libsecurity in Apple Mac OS X 10.5.8 and 10.6.4 does not properly perform comparisons to domain-name strings in X.509 certificates, which allows man-in-the-middle attackers to spoof SSL servers via a certificate associated with a similar domain name, as demonstrated by use of a www.example.con certificate to spoof www.example.com.

Affected Software

5 affected components

Apple libsecurity

Apple iOS and macOS=10.5.8

Apple iOS and macOS=10.6.4

Apple Mac OS X Server=10.5.8

Apple Mac OS X Server=10.6.4

Remediation

Patch Available

http://support.apple.com/kb/HT4312

Event History

Aug 25, 2010

CVE Published

via MITRE·07:00 PM

Data Sourced

via MITRE·07:00 PM

Description

Data Sourced

08:00 PM

DescriptionWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2010-1802?

CVE-2010-1802 is considered to be of high severity due to its potential for man-in-the-middle attacks.

How do I fix CVE-2010-1802?

CVE-2010-1802 can be mitigated by updating to a newer version of macOS that has addressed the vulnerability.

Which versions of macOS are affected by CVE-2010-1802?

CVE-2010-1802 affects macOS versions 10.5.8 and 10.6.4.

What type of attacks can CVE-2010-1802 facilitate?

CVE-2010-1802 can facilitate man-in-the-middle attacks allowing attackers to spoof SSL servers.

Who is impacted by CVE-2010-1802?

Users of Apple macOS 10.5.8 and 10.6.4, particularly in secure communications, are impacted by CVE-2010-1802.