MyProxy SSL Certificate Validation Security Bypass Vulnerability

Bugtraq ID:	45916
Class:	Design Error
CVE:	CVE-2011-0738
Remote:	Yes
Local:	No
Published:	Jan 19 2011 12:00AM
Updated:	Apr 13 2015 09:21PM
Credit:	Venkat Yekkirala (NCSA).
Vulnerable:	MyProxy Project MyProxy 5.2 MyProxy Project MyProxy 5.1 MyProxy Project MyProxy 5.0 Globus Globus Toolkit 5.0.2 Globus Globus Toolkit 5.0.1 Globus Globus Toolkit 5.0.0
Not Vulnerable:	MyProxy Project MyProxy 5.3

MyProxy SSL Certificate Validation Security Bypass Vulnerability

MyProxy is prone to a security-bypass vulnerability because the application fails to properly validate SSL certificates from a server.

Successfully exploiting this issue allows attackers to perform man-in-the-middle attacks or impersonate trusted servers, which will aid in further attacks.

MyProxy 5.0, 5.1, and 5.2 are vulnerable.

MyProxy SSL Certificate Validation Security Bypass Vulnerability

An attacker can use readily available network utilities to exploit this issue.

MyProxy SSL Certificate Validation Security Bypass Vulnerability

Solution:
Updates are available. Please see the references for more details.

MyProxy SSL Certificate Validation Security Bypass Vulnerability

References:

• Globus ToolKit (Globus Alliance)
  
• MyProxy Homepage (MyProxy Project)
  
• Globus Security Advisory 2011-01: myproxy-logon identity checking of server (Globus)