Microsoft Windows Phone 7 SSL Certificate 'Common Name' Validation Security Bypass Vulnerability

Bugtraq ID:	55569
Class:	Design Error
CVE:	CVE-2012-2993
Remote:	Yes
Local:	No
Published:	Sep 17 2012 12:00AM
Updated:	Sep 17 2012 12:00AM
Credit:	An anonymous researcher.
Vulnerable:	Microsoft Windows Phone 7
Not Vulnerable:

Microsoft Windows Phone 7 SSL Certificate 'Common Name' Validation Security Bypass Vulnerability

Microsoft Windows Phone 7 is prone to a security-bypass vulnerability because the application fails to properly validate SSL certificates from a server.

Successfully exploiting this issue allows attackers to perform man-in-the-middle attacks or impersonate trusted servers, which will aid further attacks.

Microsoft Windows Phone 7 SSL Certificate 'Common Name' Validation Security Bypass Vulnerability

Attackers can use readily available tools to exploit this issue.

Microsoft Windows Phone 7 SSL Certificate 'Common Name' Validation Security Bypass Vulnerability

Solution:
Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Microsoft Windows Phone 7 SSL Certificate 'Common Name' Validation Security Bypass Vulnerability

References:

• Windows Phone Home page (Windows)