BID:34973

Apple Mac OS X iChat Disabled SSL Connection Information Disclosure Vulnerability

Info

Apple Mac OS X iChat Disabled SSL Connection Information Disclosure Vulnerability

Bugtraq ID:	34973
Class:	Design Error
CVE:	CVE-2009-0152
Remote:	Yes
Local:	No
Published:	May 12 2009 12:00AM
Updated:	May 14 2009 10:46PM
Credit:	Apple
Vulnerable:	Apple Mac OS X Server 10.5.6 Apple Mac OS X Server 10.5.5 Apple Mac OS X Server 10.5.4 Apple Mac OS X Server 10.5.3 Apple Mac OS X Server 10.5.2 Apple Mac OS X Server 10.5.1 Apple Mac OS X Server 10.5 Apple Mac OS X 10.5.6 Apple Mac OS X 10.5.5 Apple Mac OS X 10.5.4 Apple Mac OS X 10.5.3 Apple Mac OS X 10.5.2 Apple Mac OS X 10.5.1 Apple Mac OS X 10.5

Not Vulnerable:	Apple Mac OS X Server 10.5.7 Apple Mac OS X 10.5.7

Discussion

Apple Mac OS X iChat Disabled SSL Connection Information Disclosure Vulnerability

Apple Mac OS X is prone to an information-disclosure vulnerability because the iChat component may transmit sensitive information in plaintext format.

An attacker could leverage this vulnerability via man-in-the-middle techniques to obtain potentially sensitive information that may aid in further attacks.

NOTE: This issue was previously covered in BID 34926 (Apple Mac OS X 2009-002 Multiple Security Vulnerabilities), but has been assigned its own record to better document it.

Exploit / POC

Apple Mac OS X iChat Disabled SSL Connection Information Disclosure Vulnerability

Attackers can perform man-in-the-middle attacks to exploit this issue.

Solution / Fix

Apple Mac OS X iChat Disabled SSL Connection Information Disclosure Vulnerability

Solution:
The vendor has released an advisory and fixes. Please see the references for details.

Apple Mac OS X 10.5