Perdition SSL/TLS Certificate Validation Security Bypass Vulnerability
BID:63696
CVE-2013-4584 |Info
Perdition SSL/TLS Certificate Validation Security Bypass Vulnerability
| Bugtraq ID: | 63696 |
| Class: | Design Error |
| CVE: |
CVE-2013-4584 |
| Remote: | Yes |
| Local: | No |
| Published: | Nov 08 2013 12:00AM |
| Updated: | Nov 19 2013 04:13AM |
| Credit: | Daniel Kahn Gillmor |
| Vulnerable: |
Perdition Perdition Mail Retrieval Proxy 1.17.1 Perdition Perdition Mail Retrieval Proxy 1.17 |
| Not Vulnerable: | |
Discussion
Perdition SSL/TLS Certificate Validation Security Bypass Vulnerability
Perdition is prone to a security-bypass vulnerability because the application fails to properly validate SSL/TLS certificates from the server.
Successfully exploiting this issue allows attackers to perform man-in-the-middle attacks or impersonate trusted servers, which will aid in further attacks.
Perdition 2.0 and prior are vulnerable.
Perdition is prone to a security-bypass vulnerability because the application fails to properly validate SSL/TLS certificates from the server.
Successfully exploiting this issue allows attackers to perform man-in-the-middle attacks or impersonate trusted servers, which will aid in further attacks.
Perdition 2.0 and prior are vulnerable.
Exploit / POC
Perdition SSL/TLS Certificate Validation Security Bypass Vulnerability
An attacker can use readily available network utilities to exploit this issue.
An attacker can use readily available network utilities to exploit this issue.
Solution / Fix
Perdition SSL/TLS Certificate Validation Security Bypass Vulnerability
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.
References
Perdition SSL/TLS Certificate Validation Security Bypass Vulnerability
References:
References:
- Perdition Homepage (Perdition)