CVE-2010-3901: Input Validation
OpenConnect before 2.25 does not properly validate X.509 certificates, which allows man-in-the-middle attackers to spoof arbitrary AnyConnect SSL VPN servers via a crafted server certificate that (1) does not correspond to the server hostname or (2) is presented in circumstances involving a missing --cafile configuration option.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2010-3901?
CVE-2010-3901 is classified as a high severity vulnerability due to its potential exploitation by man-in-the-middle attackers.
How do I fix CVE-2010-3901?
To mitigate CVE-2010-3901, upgrade OpenConnect to version 2.25 or later, where the certificate validation issue has been resolved.
What kind of attacks can exploit CVE-2010-3901?
CVE-2010-3901 allows man-in-the-middle attacks where attackers can spoof AnyConnect SSL VPN servers using crafted server certificates.
Which versions of OpenConnect are affected by CVE-2010-3901?
CVE-2010-3901 affects OpenConnect versions prior to 2.25, including versions 1.00 through 2.22.
What is the nature of the vulnerability in CVE-2010-3901?
The vulnerability in CVE-2010-3901 involves improper validation of X.509 certificates, leading to potential security risks during VPN connections.