CVE-2013-5143 - The RADIUS service in Server App in Apple OS X Server before 3.0 selects a fallback X.509 certificat

CVE-2013-5143

Summary

The RADIUS service in Server App in Apple OS X Server before 3.0 selects a fallback X.509 certificate in unspecified circumstances, which might allow man-in-the-middle attackers to hijack RADIUS sessions by leveraging knowledge of the private key that matches this fallback certificate.

References

http://lists.apple.com/archives/security-announce/2013/Oct/msg00006.html

Vulnerable Configurations

cpe:2.3:o:apple:os_x_server:2.0:*:*:*:*:*:*:*
cpe:2.3:o:apple:os_x_server:2.0:*:*:*:*:*:*:*
cpe:2.3:o:apple:os_x_server:2.1:*:*:*:*:*:*:*
cpe:2.3:o:apple:os_x_server:2.1:*:*:*:*:*:*:*
cpe:2.3:o:apple:os_x_server:2.1.1:*:*:*:*:*:*:*
cpe:2.3:o:apple:os_x_server:2.1.1:*:*:*:*:*:*:*
cpe:2.3:o:apple:os_x_server:2.2:*:*:*:*:*:*:*
cpe:2.3:o:apple:os_x_server:2.2:*:*:*:*:*:*:*
cpe:2.3:o:apple:os_x_server:2.2.1:*:*:*:*:*:*:*
cpe:2.3:o:apple:os_x_server:2.2.1:*:*:*:*:*:*:*
cpe:2.3:o:apple:os_x_server:2.2.2:*:*:*:*:*:*:*
cpe:2.3:o:apple:os_x_server:2.2.2:*:*:*:*:*:*:*

CVSS

Base:	6.8 (as of 24-10-2013 - 16:59)
Impact:
Exploitability:

CWE

NVD-CWE-Other

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	MEDIUM	NONE

Impact

Confidentiality	Integrity	Availability
PARTIAL	PARTIAL	PARTIAL

cvss-vector via4

AV:N/AC:M/Au:N/C:P/I:P/A:P

refmap via4

apple

APPLE-SA-2013-10-22-5

Last major update

24-10-2013 - 16:59

Published

24-10-2013 - 10:53

Last modified

24-10-2013 - 16:59