Yafuoku! SSL Certificate Validation Information Disclosure Vulnerability
BID:61818
Info
Yafuoku! SSL Certificate Validation Information Disclosure Vulnerability
| Bugtraq ID: | 61818 |
| Class: | Input Validation Error |
| CVE: |
CVE-2013-4699 |
| Remote: | Yes |
| Local: | No |
| Published: | Aug 19 2013 12:00AM |
| Updated: | Aug 19 2013 12:00AM |
| Credit: | Zachary Mathis of Proactive Defense |
| Vulnerable: | |
| Not Vulnerable: | |
Discussion
Yafuoku! SSL Certificate Validation Information Disclosure Vulnerability
Yafuoku! is prone to an information disclosure vulnerability.
An attacker can exploit this issue through man-in-the-middle attacks by impersonating a trusted server. This may allow the attacker to obtain or modify sensitive information. Information harvested may aid in further attacks.
Yafuoku! 4.3.0 and prior versions are vulnerable.
Yafuoku! is prone to an information disclosure vulnerability.
An attacker can exploit this issue through man-in-the-middle attacks by impersonating a trusted server. This may allow the attacker to obtain or modify sensitive information. Information harvested may aid in further attacks.
Yafuoku! 4.3.0 and prior versions are vulnerable.
Exploit / POC
Yafuoku! SSL Certificate Validation Information Disclosure Vulnerability
An attacker can use readily available network utilities to exploit this issue.
An attacker can use readily available network utilities to exploit this issue.
Solution / Fix
Yafuoku! SSL Certificate Validation Information Disclosure Vulnerability
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.
References
Yafuoku! SSL Certificate Validation Information Disclosure Vulnerability
References:
References:
- Yahoo! Homepage (Yahoo!)