FileMaker Pro CVE-2014-5321 SSL Certificate Validation Spoofing Vulnerability

Bugtraq ID:	69986
Class:	Design Error
CVE:	CVE-2014-5321
Remote:	Yes
Local:	No
Published:	Sep 19 2014 12:00AM
Updated:	Sep 19 2014 12:00AM
Credit:	JPCERT
Vulnerable:
Not Vulnerable:

FileMaker Pro CVE-2014-5321 SSL Certificate Validation Spoofing Vulnerability

FileMaker Pro and FileMaker Pro Advanced are prone to a security vulnerability that may allow attackers to conduct spoofing attacks.

Attackers can exploit this issue to spoof a valid server and conduct man-in-the-middle attacks. Successful exploits will cause victims to accept the certificates assuming they are from a legitimate site.

The following versions are vulnerable:

Versions prior to FileMaker Pro 13
Versions prior to FileMaker Pro Advanced 13

Note: This issue is the result of an incomplete fix for the issue described in 60372 (FileMaker Pro and FileMaker Pro Advanced SSL Certificate Validation Spoofing Vulnerability).

FileMaker Pro CVE-2014-5321 SSL Certificate Validation Spoofing Vulnerability

Attackers can use readily available tools to exploit this issue.

FileMaker Pro CVE-2014-5321 SSL Certificate Validation Spoofing Vulnerability

References:

• FileMaker Homepage (FileMaker Inc.)