Apple Safari CFNetwork Root Certificate Security Bypass Vulnerability

Bugtraq ID:	48837
Class:	Design Error
CVE:	CVE-2011-0214
Remote:	Yes
Local:	No
Published:	Jul 20 2011 12:00AM
Updated:	Jul 20 2011 12:00AM
Credit:	Anonymous
Vulnerable:	Apple Safari 3.1.2 for Windows Apple Safari 3.1.1 for Windows Apple Safari 5.0.5 for Windows Apple Safari 5.0.5 Apple Safari 5.0.4 for Windows Apple Safari 5.0.4 Apple Safari 5.0.3 for Windows Apple Safari 5.0.3 Apple Safari 5.0.2 for Windows Apple Safari 5.0.2 Apple Safari 5.0.1 for Windows Apple Safari 5.0.1 Apple Safari 5.0 for Windows Apple Safari 5.0 Apple Safari 3.1 for Windows
Not Vulnerable:	Apple Safari 5.0.6 Apple Safari 5.1 for Windows Apple Safari 5.1 Apple Safari 5.0.6 for windows

Apple Safari CFNetwork Root Certificate Security Bypass Vulnerability

Apple Safari is prone to a security-bypass vulnerability.

An attacker can exploit this issue to accept forged root certificates. Successfully exploiting this issue allows attackers to perform man-in-the-middle attacks or impersonate trusted servers, which will aid in further attacks.

NOTE: This issue was previously discussed in 48808 (Apple Safari Prior to 5.1 and 5.0.6 Multiple Security Vulnerabilities) but has been given its own record to better document it.

Apple Safari CFNetwork Root Certificate Security Bypass Vulnerability

Solution:
The vendor released updates. Please see the references for details.

Apple Safari CFNetwork Root Certificate Security Bypass Vulnerability

References:

• Apple Safari Homepage (Apple)