aMSN (aka Alvaro's Messenger) 0.98.3 and earlier, when SSL is...
Vulnerability Description
aMSN (aka Alvaro's Messenger) 0.98.3 and earlier, when SSL is used, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) field or a Subject Alternative Name field of the X.509 certificate, which allows man-in-the-middle attackers to spoof an MSN server via an arbitrary certificate.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2010-0744
Credits & Attribution
No credits recorded in the NVD database.
References
- http://lists.fedoraproject.org/pipermail/package-announce/2010-May/041046.html
- http://amsn.svn.sourceforge.net/viewvc/amsn/trunk/?view=log&pathrev=11991
- http://www.openwall.com/lists/oss-security/2010/03/10/4
- http://secunia.com/advisories/39796
- http://amsn.svn.sourceforge.net/viewvc/amsn/trunk/amsn/sip.tcl?r1=11953&r2=11991&pathrev=11991
- http://amsn.svn.sourceforge.net/viewvc/amsn/trunk/amsn/proxy.tcl?r1=11886&r2=11991&pathrev=11991
- http://www.securityfocus.com/bid/35507
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=572818
- http://www.openwall.com/lists/oss-security/2010/04/01/4
- http://seclists.org/bugtraq/2009/Jun/239
- http://www.opensource-archive.org/showthread.php?p=183821
- http://amsn.svn.sourceforge.net/viewvc/amsn/trunk/amsn/soap.tcl?r1=11891&r2=11991&pathrev=11991
- http://secunia.com/advisories/35621
- http://www.vupen.com/english/advisories/2010/1109
- http://lists.fedoraproject.org/pipermail/package-announce/2010-May/041079.html
Affected Vendor
alvaro
View all reports →Affected Software
Timeline
CVSS Vectors
Weaknesses (CWE)
No CWE data available
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.