NVD Vulnerability Detail

CVE-2013-0289

Summary	Isync 0.4 before 1.0.6, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
Publication Date	May 23, 2014, 11:55 p.m.
Registration Date	Jan. 26, 2021, 3:33 p.m.
Last Update	Nov. 21, 2024, 10:47 a.m.

Affected software configurations

Related information, measures and tools

No	URL	タグ
1	http://lists.fedoraproject.org/pipermail/package-announce/2013-March/099544.html
2	http://lists.fedoraproject.org/pipermail/package-announce/2013-March/099544.html
3	http://lists.fedoraproject.org/pipermail/package-announce/2013-March/099547.html
4	http://lists.fedoraproject.org/pipermail/package-announce/2013-March/099547.html
5	http://secunia.com/advisories/55190
6	http://secunia.com/advisories/55190
7	http://security.gentoo.org/glsa/glsa-201310-02.xml
8	http://security.gentoo.org/glsa/glsa-201310-02.xml
9	http://sourceforge.net/p/isync/isync/ci/914ede18664980925628a9ed2a73ad05f85aeedb	Vendor Advisory
10	http://sourceforge.net/p/isync/isync/ci/914ede18664980925628a9ed2a73ad05f85aeedb	Vendor Advisory
11	http://sourceforge.net/projects/isync/files/isync/1.0.6/	Patch
12	http://sourceforge.net/projects/isync/files/isync/1.0.6/	Patch
13	http://www.openwall.com/lists/oss-security/2013/02/20/9
14	http://www.openwall.com/lists/oss-security/2013/02/20/9
15	http://www.securityfocus.com/bid/57423
16	http://www.securityfocus.com/bid/57423
17	https://exchange.xforce.ibmcloud.com/vulnerabilities/82232
18	https://exchange.xforce.ibmcloud.com/vulnerabilities/82232

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-310	暗号の問題	https://cwe.mitre.org/data/definitions/310.html

JVN Vulnerability Information

Isync における SSL サーバになりすまされる脆弱性

Title	Isync における SSL サーバになりすまされる脆弱性
Summary	Isync は、X.509 証明書のサブジェクトの Common Name (CN) または SubjectAltName フィールド内のドメイン名とサーバのホスト名が一致することを検証しないため、SSL サーバになりすまされる脆弱性が存在します。
Possible impacts	中間者攻撃 (man-in-the-middle attack) により、任意の有効な証明書を介して、SSL サーバになりすまされる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Feb. 3, 2013, midnight
Registration Date	May 28, 2014, 10:38 a.m.
Last Update	May 28, 2014, 10:38 a.m.

Affected System

isync-devel

Isync 0.4 以上 1.0.6 未満

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2013-0289	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0289
National Vulnerability Database (NVD)
2	CVE-2013-0289	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-0289

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-310	https://jvndb.jvn.jp/ja/cwe/CWE-310.html

ベンダー情報

No	Name	URL
SourceForge
1	Isync: mailbox synchronizer - Browse /isync/1.0.6 at SourceForge.net	http://sourceforge.net/projects/isync/files/isync/1.0.6/
2	Isync: mailbox synchronizer / isync / Commit [914ede]	http://sourceforge.net/p/isync/isync/ci/914ede18664980925628a9ed2a73ad05f85aeedb

Change Log

No	Changed Details	Date of change
0	[2014年05月28日] 掲載	Feb. 17, 2018, 10:37 a.m.