CVE-2011-3422: Input Validation
The Keychain implementation in Apple Mac OS X 10.6.8 and earlier does not properly handle an untrusted attribute of a Certification Authority certificate, which makes it easier for man-in-the-middle attackers to spoof arbitrary SSL servers via an Extended Validation certificate, as demonstrated by https access with Safari.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2011-3422?
CVE-2011-3422 is considered a high-severity vulnerability due to its potential for man-in-the-middle attacks.
How do I fix CVE-2011-3422?
To resolve CVE-2011-3422, upgrade to a version of Mac OS X later than 10.6.8 where the vulnerability has been patched.
What systems are affected by CVE-2011-3422?
CVE-2011-3422 affects Apple Mac OS X versions 10.6.0 through 10.6.8 and their corresponding server versions.
What kind of attacks can CVE-2011-3422 facilitate?
CVE-2011-3422 can facilitate man-in-the-middle attacks by allowing spoofing of SSL servers through compromised certificates.
Is there a workaround for CVE-2011-3422?
There is no official workaround for CVE-2011-3422, upgrading the operating system is the recommended action.