CVE-2011-0228

Related Files

iOS SSL Implementation Certificate Validation Fail

Posted Jul 26, 2011

Authored by Trustwave | Site trustwave.com

iOS's SSL certificate parsing contains a flaw where it fails to check the basicConstraints parameter of certificates in the chain. By signing a new certificate using a legitimate end entity certificate, an attacker can obtain a "valid" certificate for any domain.

tags | advisory

systems | cisco

advisories | CVE-2011-0228

SHA-256 | 434dce4a3760a9007c3d719b3ef5ed6a9779f57077aab4e7c303f1688be36903

Download | Favorite | View

Apple Security Advisory 2011-07-25-1

Posted Jul 25, 2011

Authored by Apple | Site apple.com

Apple Security Advisory 2011-07-25-1 - A certificate chain validation issue existed in the handling of X.509 certificates. An attacker with a privileged network position may capture or modify data in sessions protected by SSL/TLS. Other attacks involving X.509 certificate validation may also be possible. This issue is addressed through improved validation of X.509 certificate chains. The iOS 4.3.5 software update addresses this issue.

tags | advisory

systems | cisco, apple

advisories | CVE-2011-0228

SHA-256 | f271d72e253f45b8bffad97ab4c2940113b5aed5d35f40980c0aa9611dd0e416

Download | Favorite | View

Apple Security Advisory 2011-07-25-2

Posted Jul 25, 2011

Authored by Apple | Site apple.com

Apple Security Advisory 2011-07-25-2 - The iOS 4.2.10 software update addresses a certificate chain validation issue. The issue existed in the handling of X.509 certificates where an attacker with a privileged network position may capture or modify data in sessions protected by SSL/TLS. Other attacks involving X.509 certificate validation may also be possible. This issue is addressed through improved validation of X.509 certificate chains.

tags | advisory

systems | cisco, apple

advisories | CVE-2011-0228

SHA-256 | a9341b8d975d38e6fee68438897e57464648354bf839acda89e25f93a633a05b

Download | Favorite | View