QwikSec

Security Database

CVE

CWE

Training

CVE-2007-6592

Published: Dec 28, 2007

Modified: Aug 7, 2024

PUBLISHED

Description

Apple Safari 2, when a user accepts an SSL server certificate on the basis of the CN domain name in the DN field, regards the certificate as also accepted for all domain names in subjectAltName:dNSName fields, which makes it easier for remote attackers to trick a user into accepting an invalid certificate for a spoofed web site.

Vendor	Product	Versions
n/a	n/a	affected `n/a`

References

third-party-advisory

x_refsource_SREASON

20071118 Re: Certificate spoofing issue with Mozilla, Konqueror, Safari 2

mailing-list

x_refsource_BUGTRAQ

20071118 Certificate spoofing issue with Mozilla, Konqueror, Safari 2

mailing-list

x_refsource_BUGTRAQ

http://nils.toedtmann.net/pub/subjectAltName.txt

x_refsource_MISC

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.