CVE-2015-3996 - The default AFSecurityPolicy.validatesDomainName configuration for AFSSLPinningModeNone in the AFNet

CVE-2015-3996

Summary

The default AFSecurityPolicy.validatesDomainName configuration for AFSSLPinningModeNone in the AFNetworking framework before 2.5.3, as used in the ownCloud iOS Library, disables verification of a server hostname against the domain name in the subject's Common Name (CN) of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

References

Vulnerable Configurations

cpe:2.3:a:afnetworking_project:afnetworking:2.5.2:*:*:*:*:*:*:*
cpe:2.3:a:afnetworking_project:afnetworking:2.5.2:*:*:*:*:*:*:*

CVSS

Base:	4.3 (as of 28-10-2015 - 18:41)
Impact:
Exploitability:

CWE

CWE-254

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	MEDIUM	NONE

Impact

Confidentiality	Integrity	Availability
NONE	PARTIAL	NONE

cvss-vector via4

AV:N/AC:M/Au:N/C:N/I:P/A:N

refmap via4

bid	76242
confirm	https://github.com/AFNetworking/AFNetworking/issues/2619 https://github.com/AFNetworking/AFNetworking/releases/tag/2.5.3 https://owncloud.org/security/advisory/?id=oc-sa-2015-012

Last major update

28-10-2015 - 18:41

Published

27-10-2015 - 16:59

Last modified

28-10-2015 - 18:41