CVE-2012-0655

2012-05-1103:49:00

CWE-310

[email protected]

web.nvd.nist.gov

apple

mac os x

libsecurity

cve-2012-0655

x.509 certificates

rsa keys

cryptographic protection

spoofing

network-sniffing

6.2 Medium

AI Score

Confidence

Low

6.4 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:P/A:N

0.002 Low

EPSS

Percentile

64.6%

JSON

libsecurity in Apple Mac OS X before 10.7.4 does not properly restrict the length of RSA keys within X.509 certificates, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by conducting a spoofing or network-sniffing attack during communication with a site that uses a short key.

CPENameOperatorVersion
apple:mac_os_xapple mac os xeq10.5.8
apple:mac_os_xapple mac os xeq10.4.3
apple:mac_os_xapple mac os xeq10.6.8
apple:mac_os_xapple mac os xeq10.2.5
apple:mac_os_xapple mac os xeq10.6.7
apple:mac_os_xapple mac os xeq10.2.7
apple:mac_os_xapple mac os xeq10.0.2
apple:mac_os_xapple mac os xeq10.2.8
apple:mac_os_xapple mac os xeq10.2.1
apple:mac_os_xapple mac os xeq10.5.6

CPE	Name	Operator	Version
apple:mac_os_x	apple mac os x	eq	10.5.8
apple:mac_os_x	apple mac os x	eq	10.4.3
apple:mac_os_x	apple mac os x	eq	10.6.8
apple:mac_os_x	apple mac os x	eq	10.2.5
apple:mac_os_x	apple mac os x	eq	10.6.7
apple:mac_os_x	apple mac os x	eq	10.2.7
apple:mac_os_x	apple mac os x	eq	10.0.2
apple:mac_os_x	apple mac os x	eq	10.2.8
apple:mac_os_x	apple mac os x	eq	10.2.1
apple:mac_os_x	apple mac os x	eq	10.5.6