var-201003-0205
Vulnerability from variot
Mail in Apple Mac OS X before 10.6.3 does not properly enforce the key usage extension during processing of a keychain that specifies multiple certificates for an e-mail recipient, which might make it easier for remote attackers to obtain sensitive information via a brute-force attack on a weakly encrypted e-mail message. Apple Mac OS X is prone to a security-bypass vulnerability in Mail. Attackers can exploit this issue, likely with a man-in-the-middle attack, to potentially decrypt email messages that were encrypted with unexpectedly weak encryption keys. Other attacks may also be possible. The following are vulnerable: Mac OS X 10.5.8 Mac OS X Server 10.5.8 Mac OS X 10.6 through 10.6.2 Mac OS X Server 10.6 through 10.6.2 NOTE: This issue was previously covered in BID 39020 (Apple Mac OS X APPLE-SA-2010-03-29-1 Multiple Security Vulnerabilities) but has been assigned its own record to better document it. There is a logic error in Mail's handling of encryption certificates. Mail may choose an encryption key that was not intended when there are multiple certificates for the recipient in the keychain. If the key is cryptographically weaker than the expected key, it can cause security issues
Show details on source website{ "@context": { "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#", "affected_products": { "@id": "https://www.variotdbs.pl/ref/affected_products" }, "configurations": { "@id": "https://www.variotdbs.pl/ref/configurations" }, "credits": { "@id": "https://www.variotdbs.pl/ref/credits" }, "cvss": { "@id": "https://www.variotdbs.pl/ref/cvss/" }, "description": { "@id": "https://www.variotdbs.pl/ref/description/" }, "exploit_availability": { "@id": "https://www.variotdbs.pl/ref/exploit_availability/" }, "external_ids": { "@id": "https://www.variotdbs.pl/ref/external_ids/" }, "iot": { "@id": "https://www.variotdbs.pl/ref/iot/" }, "iot_taxonomy": { "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/" }, "patch": { "@id": "https://www.variotdbs.pl/ref/patch/" }, "problemtype_data": { "@id": "https://www.variotdbs.pl/ref/problemtype_data/" }, "references": { "@id": "https://www.variotdbs.pl/ref/references/" }, "sources": { "@id": "https://www.variotdbs.pl/ref/sources/" }, "sources_release_date": { "@id": "https://www.variotdbs.pl/ref/sources_release_date/" }, "sources_update_date": { "@id": "https://www.variotdbs.pl/ref/sources_update_date/" }, "threat_type": { "@id": "https://www.variotdbs.pl/ref/threat_type/" }, "title": { "@id": "https://www.variotdbs.pl/ref/title/" }, "type": { "@id": "https://www.variotdbs.pl/ref/type/" } }, "@id": "https://www.variotdbs.pl/vuln/VAR-201003-0205", "affected_products": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/affected_products#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" }, "@id": "https://www.variotdbs.pl/ref/sources" } }, "data": [ { "model": "mac os x", "scope": "eq", "trust": 1.6, "vendor": "apple", "version": "10.5.4" }, { "model": "mac os x", "scope": "eq", "trust": 1.6, "vendor": "apple", "version": "10.5.5" }, { "model": "mac os x", "scope": "eq", "trust": 1.6, "vendor": "apple", "version": "10.5.2" }, { "model": "mac os x", "scope": "eq", "trust": 1.6, "vendor": "apple", "version": "10.5.0" }, { "model": "mac os x", "scope": "eq", "trust": 1.6, "vendor": "apple", "version": "10.5.1" }, { "model": "mac os x", "scope": "eq", "trust": 1.6, "vendor": "apple", "version": "10.5.7" }, { "model": "mac os x server", "scope": "eq", "trust": 1.6, "vendor": "apple", "version": "10.5.1" }, { "model": "mac os x server", "scope": "eq", "trust": 1.6, "vendor": "apple", "version": "10.5.0" }, { "model": "mac os x", "scope": "eq", "trust": 1.6, "vendor": "apple", "version": "10.5.3" }, { "model": "mac os x", "scope": "eq", "trust": 1.6, "vendor": "apple", "version": "10.5.6" }, { "model": "mac os x", "scope": "eq", "trust": 1.0, "vendor": "apple", "version": "10.6.1" }, { "model": "mac os x server", "scope": "eq", "trust": 1.0, "vendor": "apple", "version": "10.5.4" }, { "model": "mac os x server", "scope": "eq", "trust": 1.0, "vendor": "apple", "version": "10.5.6" }, { "model": "mac os x server", "scope": "eq", "trust": 1.0, "vendor": "apple", "version": "10.5.3" }, { "model": "mac os x server", "scope": "eq", "trust": 1.0, "vendor": "apple", "version": "10.6.1" }, { "model": "mac os x server", "scope": "eq", "trust": 1.0, "vendor": "apple", "version": "10.6.0" }, { "model": "mac os x", "scope": "eq", "trust": 1.0, "vendor": "apple", "version": "10.6.0" }, { "model": "mac os x server", "scope": "eq", "trust": 1.0, "vendor": "apple", "version": "10.5.8" }, { "model": "mac os x", "scope": "eq", "trust": 1.0, "vendor": "apple", "version": "10.5.8" }, { "model": "mac os x server", "scope": "lte", "trust": 1.0, "vendor": "apple", "version": "10.6.2" }, { "model": "mac os x server", "scope": "eq", "trust": 1.0, "vendor": "apple", "version": "10.5.2" }, { "model": "mac os x server", "scope": "eq", "trust": 1.0, "vendor": "apple", "version": "10.5.5" }, { "model": "mac os x", "scope": "lte", "trust": 1.0, "vendor": "apple", "version": "10.6.2" }, { "model": "mac os x server", "scope": "eq", "trust": 1.0, "vendor": "apple", "version": "10.5.7" }, { "model": "mac os x", "scope": "eq", "trust": 0.8, "vendor": "apple", "version": "v10.5.8" }, { "model": "mac os x", "scope": "eq", "trust": 0.8, "vendor": "apple", "version": "v10.6 to v10.6.2" }, { "model": "mac os x server", "scope": "eq", "trust": 0.8, "vendor": "apple", "version": "v10.5.8" }, { "model": "mac os x server", "scope": "eq", "trust": 0.8, "vendor": "apple", "version": "v10.6 to v10.6.2" }, { "model": "mac os server", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "x10.6.2" }, { "model": "mac os server", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "x10.6.1" }, { "model": "mac os server", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "x10.5.8" }, { "model": "mac os server", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "x10.5.7" }, { "model": "mac os server", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "x10.5.6" }, { "model": "mac os server", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "x10.5.5" }, { "model": "mac os server", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "x10.5.4" }, { "model": "mac os server", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "x10.5.3" }, { "model": "mac os server", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "x10.5.2" }, { "model": "mac os server", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "x10.5.1" }, { "model": "mac os server", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "x10.6" }, { "model": "mac os server", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "x10.5" }, { "model": "mac os", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "x10.6.2" }, { "model": "mac os", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "x10.6.1" }, { "model": "mac os", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "x10.5.8" }, { "model": "mac os", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "x10.5.7" }, { "model": "mac os", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "x10.5.6" }, { "model": "mac os", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "x10.5.5" }, { "model": "mac os", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "x10.5.4" }, { "model": "mac os", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "x10.5.3" }, { "model": "mac os", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "x10.5.2" }, { "model": "mac os", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "x10.5.1" }, { "model": "mac os", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "x10.6" }, { "model": "mac os", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "x10.5" }, { "model": "mac os server", "scope": "ne", "trust": 0.3, "vendor": "apple", "version": "x10.6.3" }, { "model": "mac os", "scope": "ne", "trust": 0.3, "vendor": "apple", "version": "x10.6.3" } ], "sources": [ { "db": "BID", "id": "39279" }, { "db": "JVNDB", "id": "JVNDB-2010-001264" }, { "db": "CNNVD", "id": "CNNVD-201003-487" }, { "db": "NVD", "id": "CVE-2010-0525" } ] }, "configurations": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/configurations#", "children": { "@container": "@list" }, "cpe_match": { "@container": "@list" }, "data": { "@container": "@list" }, "nodes": { "@container": "@list" } }, "data": [ { "CVE_data_version": "4.0", "nodes": [ { "cpe_match": [ { "cpe22Uri": "cpe:/o:apple:mac_os_x", "vulnerable": true }, { "cpe22Uri": "cpe:/o:apple:mac_os_x_server", "vulnerable": true } ], "operator": "OR" } ] } ], "sources": [ { "db": "JVNDB", "id": "JVNDB-2010-001264" } ] }, "credits": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/credits#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "Michael KisorDamian Put\u203b pucik@cc-team.org", "sources": [ { "db": "CNNVD", "id": "CNNVD-201003-487" } ], "trust": 0.6 }, "cve": "CVE-2010-0525", "cvss": { "@context": { "cvssV2": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#" }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2" }, "cvssV3": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#" }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/" }, "severity": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/cvss/severity#" }, "@id": "https://www.variotdbs.pl/ref/cvss/severity" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" }, "@id": "https://www.variotdbs.pl/ref/sources" } }, "data": [ { "cvssV2": [ { "accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "author": "nvd@nist.gov", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "PARTIAL", "exploitabilityScore": 10.0, "id": "CVE-2010-0525", "impactScore": 2.9, "integrityImpact": "NONE", "severity": "MEDIUM", "trust": 1.0, "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0" }, { "acInsufInfo": null, "accessComplexity": "Low", "accessVector": "Network", "authentication": "None", "author": "NVD", "availabilityImpact": "None", "baseScore": 7.8, "confidentialityImpact": "Complete", "exploitabilityScore": null, "id": "CVE-2010-0525", "impactScore": null, "integrityImpact": "None", "obtainAllPrivilege": null, "obtainOtherPrivilege": null, "obtainUserPrivilege": null, "severity": "High", "trust": 0.8, "userInteractionRequired": null, "vectorString": "AV:N/AC:L/Au:N/C:C/I:N/A:N", "version": "2.0" }, { "accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "author": "VULHUB", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "PARTIAL", "exploitabilityScore": 10.0, "id": "VHN-43130", "impactScore": 2.9, "integrityImpact": "NONE", "severity": "MEDIUM", "trust": 0.1, "vectorString": "AV:N/AC:L/AU:N/C:P/I:N/A:N", "version": "2.0" } ], "cvssV3": [], "severity": [ { "author": "nvd@nist.gov", "id": "CVE-2010-0525", "trust": 1.0, "value": "MEDIUM" }, { "author": "NVD", "id": "CVE-2010-0525", "trust": 0.8, "value": "High" }, { "author": "CNNVD", "id": "CNNVD-201003-487", "trust": 0.6, "value": "MEDIUM" }, { "author": "VULHUB", "id": "VHN-43130", "trust": 0.1, "value": "MEDIUM" } ] } ], "sources": [ { "db": "VULHUB", "id": "VHN-43130" }, { "db": "JVNDB", "id": "JVNDB-2010-001264" }, { "db": "CNNVD", "id": "CNNVD-201003-487" }, { "db": "NVD", "id": "CVE-2010-0525" } ] }, "description": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/description#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "Mail in Apple Mac OS X before 10.6.3 does not properly enforce the key usage extension during processing of a keychain that specifies multiple certificates for an e-mail recipient, which might make it easier for remote attackers to obtain sensitive information via a brute-force attack on a weakly encrypted e-mail message. Apple Mac OS X is prone to a security-bypass vulnerability in Mail. \nAttackers can exploit this issue, likely with a man-in-the-middle attack, to potentially decrypt email messages that were encrypted with unexpectedly weak encryption keys. Other attacks may also be possible. \nThe following are vulnerable:\nMac OS X 10.5.8\nMac OS X Server 10.5.8\nMac OS X 10.6 through 10.6.2\nMac OS X Server 10.6 through 10.6.2\nNOTE: This issue was previously covered in BID 39020 (Apple Mac OS X APPLE-SA-2010-03-29-1 Multiple Security Vulnerabilities) but has been assigned its own record to better document it. There is a logic error in Mail\u0027s handling of encryption certificates. Mail may choose an encryption key that was not intended when there are multiple certificates for the recipient in the keychain. If the key is cryptographically weaker than the expected key, it can cause security issues", "sources": [ { "db": "NVD", "id": "CVE-2010-0525" }, { "db": "JVNDB", "id": "JVNDB-2010-001264" }, { "db": "BID", "id": "39279" }, { "db": "VULHUB", "id": "VHN-43130" } ], "trust": 1.98 }, "external_ids": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/external_ids#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "db": "NVD", "id": "CVE-2010-0525", "trust": 2.8 }, { "db": "JVNDB", "id": "JVNDB-2010-001264", "trust": 0.8 }, { "db": "CNNVD", "id": "CNNVD-201003-487", "trust": 0.7 }, { "db": "NSFOCUS", "id": "14715", "trust": 0.6 }, { "db": "APPLE", "id": "APPLE-SA-2010-03-29-1", "trust": 0.6 }, { "db": "BID", "id": "39279", "trust": 0.4 }, { "db": "VULHUB", "id": "VHN-43130", "trust": 0.1 } ], "sources": [ { "db": "VULHUB", "id": "VHN-43130" }, { "db": "BID", "id": "39279" }, { "db": "JVNDB", "id": "JVNDB-2010-001264" }, { "db": "CNNVD", "id": "CNNVD-201003-487" }, { "db": "NVD", "id": "CVE-2010-0525" } ] }, "id": "VAR-201003-0205", "iot": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/iot#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": true, "sources": [ { "db": "VULHUB", "id": "VHN-43130" } ], "trust": 0.01 }, "last_update_date": "2024-11-23T20:27:42.939000Z", "patch": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/patch#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "title": "HT4077", "trust": 0.8, "url": "http://support.apple.com/kb/HT4077" }, { "title": "HT4077", "trust": 0.8, "url": "http://support.apple.com/kb/HT4077?viewlocale=ja_JP" } ], "sources": [ { "db": "JVNDB", "id": "JVNDB-2010-001264" } ] }, "problemtype_data": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "problemtype": "CWE-310", "trust": 1.9 } ], "sources": [ { "db": "VULHUB", "id": "VHN-43130" }, { "db": "JVNDB", "id": "JVNDB-2010-001264" }, { "db": "NVD", "id": "CVE-2010-0525" } ] }, "references": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/references#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "trust": 1.7, "url": "http://lists.apple.com/archives/security-announce/2010//mar/msg00001.html" }, { "trust": 1.7, "url": "http://support.apple.com/kb/ht4077" }, { "trust": 0.8, "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-0525" }, { "trust": 0.8, "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2010-0525" }, { "trust": 0.6, "url": "http://www.nsfocus.net/vulndb/14715" }, { "trust": 0.3, "url": "http://www.apple.com/macosx/" } ], "sources": [ { "db": "VULHUB", "id": "VHN-43130" }, { "db": "BID", "id": "39279" }, { "db": "JVNDB", "id": "JVNDB-2010-001264" }, { "db": "CNNVD", "id": "CNNVD-201003-487" }, { "db": "NVD", "id": "CVE-2010-0525" } ] }, "sources": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", "data": { "@container": "@list" } }, "data": [ { "db": "VULHUB", "id": "VHN-43130" }, { "db": "BID", "id": "39279" }, { "db": "JVNDB", "id": "JVNDB-2010-001264" }, { "db": "CNNVD", "id": "CNNVD-201003-487" }, { "db": "NVD", "id": "CVE-2010-0525" } ] }, "sources_release_date": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#", "data": { "@container": "@list" } }, "data": [ { "date": "2010-03-30T00:00:00", "db": "VULHUB", "id": "VHN-43130" }, { "date": "2010-03-29T00:00:00", "db": "BID", "id": "39279" }, { "date": "2010-04-15T00:00:00", "db": "JVNDB", "id": "JVNDB-2010-001264" }, { "date": "2010-03-30T00:00:00", "db": "CNNVD", "id": "CNNVD-201003-487" }, { "date": "2010-03-30T18:30:01.313000", "db": "NVD", "id": "CVE-2010-0525" } ] }, "sources_update_date": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#", "data": { "@container": "@list" } }, "data": [ { "date": "2010-06-21T00:00:00", "db": "VULHUB", "id": "VHN-43130" }, { "date": "2010-03-29T00:00:00", "db": "BID", "id": "39279" }, { "date": "2010-04-15T00:00:00", "db": "JVNDB", "id": "JVNDB-2010-001264" }, { "date": "2010-03-31T00:00:00", "db": "CNNVD", "id": "CNNVD-201003-487" }, { "date": "2024-11-21T01:12:22.840000", "db": "NVD", "id": "CVE-2010-0525" } ] }, "threat_type": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/threat_type#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "remote", "sources": [ { "db": "CNNVD", "id": "CNNVD-201003-487" } ], "trust": 0.6 }, "title": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/title#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "Apple Mac OS X of Mail Vulnerability in which important information is obtained", "sources": [ { "db": "JVNDB", "id": "JVNDB-2010-001264" } ], "trust": 0.8 }, "type": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/type#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "encryption problem", "sources": [ { "db": "CNNVD", "id": "CNNVD-201003-487" } ], "trust": 0.6 } }
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.