aMSN SSL Certificate Validation Security Bypass Vulnerability

Bugtraq ID:	35507
Class:	Design Error
CVE:	CVE-2010-0744
Remote:	Yes
Local:	No
Published:	Jun 26 2009 12:00AM
Updated:	Apr 13 2015 10:16PM
Credit:	Gabriel Menezes Nunes
Vulnerable:	aMSN aMSN 0.97.2 aMSN aMSN 0.96 aMSN aMSN 0
Not Vulnerable:

aMSN SSL Certificate Validation Security Bypass Vulnerability

aMSN is prone to a security-bypass vulnerability because the application fails to properly validate SSL certificates from a server.

Successfully exploiting this issue allows attackers to perform man-in-the-middle attacks or impersonate trusted servers, which will aid in further attacks.

aMSN 0.97.2 is vulnerable; other versions may also be affected.

aMSN SSL Certificate Validation Security Bypass Vulnerability

An attacker can use readily available network utilities to exploit this issue.

aMSN SSL Certificate Validation Security Bypass Vulnerability

Solution:
Updates are available. Please see the references for more information.

aMSN SSL Certificate Validation Security Bypass Vulnerability

References:

• [Amsn-devel] Fwd: Regarding aMSN SSL Certificate Validation Security Bypass issu (aMSN)
  
• aMSN Homepage (aMSN)
  
• Revision 11991 (aMSN)
  
• aMSN SSL Certificate Vulnerability (Gabriel Menezes Nunes )