AhsayOBM and AhsayACB SSL Certificate Validation Security Bypass Vulnerability
BID:29425
Info
AhsayOBM and AhsayACB SSL Certificate Validation Security Bypass Vulnerability
| Bugtraq ID: | 29425 |
| Class: | Design Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | May 29 2008 12:00AM |
| Updated: | May 29 2008 12:00AM |
| Credit: | Heise Security |
| Vulnerable: |
Ahsay AhsayOBM 5.2 Ahsay AhsayOBM 5.1 Ahsay AhsayACB 5.2 Ahsay AhsayACB 5.1 |
| Not Vulnerable: |
Ahsay AhsayOBM 5.2.6 .3 Ahsay AhsayACB 5.2.6 .3 |
Discussion
AhsayOBM and AhsayACB SSL Certificate Validation Security Bypass Vulnerability
AhsayOBM and AhsayACB are prone to a security-bypass vulnerability because the applications fail to properly validate SSL certificates from a server.
Successfully exploiting this issue allows attackers to impersonate a trusted server through man-in-the-middle attacks. This will aid in further attacks.
AhsayOBM and AhsayACB are prone to a security-bypass vulnerability because the applications fail to properly validate SSL certificates from a server.
Successfully exploiting this issue allows attackers to impersonate a trusted server through man-in-the-middle attacks. This will aid in further attacks.
Exploit / POC
AhsayOBM and AhsayACB SSL Certificate Validation Security Bypass Vulnerability
To exploit this issue, attackers must be able to intercept legitimate network traffic through man-in-the-middle techniques.
To exploit this issue, attackers must be able to intercept legitimate network traffic through man-in-the-middle techniques.
Solution / Fix
AhsayOBM and AhsayACB SSL Certificate Validation Security Bypass Vulnerability
Solution:
The vendor has released hotfixes to address this issue. Please see the referenced advisories for more information.
Solution:
The vendor has released hotfixes to address this issue. Please see the referenced advisories for more information.
References
AhsayOBM and AhsayACB SSL Certificate Validation Security Bypass Vulnerability
References:
References: