CVE-2012-2993

Microsoft Windows Phone 7 does not verify the domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof an SSL server for the (1) POP3, (2) IMAP, or (3) SMTP protocol via an arbitrary valid certificate.

CVSS v3 5.9 MEDIUM
CVSS v2.0 2.6 LOW

5.9^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.2 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

2.6^/10

CVSS v2.0 : LOW

Vector : AV:N/AC:H/Au:N/C:P/I:N/A:N

Exploitability : 4.9 / Impact : 2.9

Access Vector NETWORK

Access Complexity HIGH

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
http://osvdb.org/85619	Broken Link
http://www.kb.cert.org/vuls/id/389795	Third Party Advisory US Government Resource
http://www.securityfocus.com/bid/55569	Broken Link Third Party Advisory VDB Entry
http://www.securitytracker.com/id?1027541	Broken Link Third Party Advisory VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/78620	Third Party Advisory VDB Entry

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:microsoft:windows_phone_7_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:microsoft:windows_phone_7:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2012-09-18 03:48

Updated : 2024-02-14 17:22

NVD link : CVE-2012-2993

Mitre link : CVE-2012-2993

CVE.ORG link : CVE-2012-2993

JSON object : View

Products Affected

microsoft

windows_phone_7_firmware
windows_phone_7

CWE

CWE-295

Improper Certificate Validation

{"id": "CVE-2012-2993", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 2.6, "accessVector": "NETWORK", "vectorString": "AV:N/AC:H/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "HIGH", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 4.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.2}]}, "published": "2012-09-18T03:48:28.507", "references": [{"url": "http://osvdb.org/85619", "tags": ["Broken Link"], "source": "cret@cert.org"}, {"url": "http://www.kb.cert.org/vuls/id/389795", "tags": ["Third Party Advisory", "US Government Resource"], "source": "cret@cert.org"}, {"url": "http://www.securityfocus.com/bid/55569", "tags": ["Broken Link", "Third Party Advisory", "VDB Entry"], "source": "cret@cert.org"}, {"url": "http://www.securitytracker.com/id?1027541", "tags": ["Broken Link", "Third Party Advisory", "VDB Entry"], "source": "cret@cert.org"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/78620", "tags": ["Third Party Advisory", "VDB Entry"], "source": "cret@cert.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-295"}]}], "descriptions": [{"lang": "en", "value": "Microsoft Windows Phone 7 does not verify the domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof an SSL server for the (1) POP3, (2) IMAP, or (3) SMTP protocol via an arbitrary valid certificate."}, {"lang": "es", "value": "Microsoft Windows Phone 7 no comprueba el nombre de dominio en el campo nombre com\u00fan(CN) del sujeto en un certificado X.509, lo que permite ataques hombre-en-el-medio (MITM) falseando un servidor SSL para los protocolos (1) POP3, (2) IMAP, o (3) SMTP a trav\u00e9s v\u00e1lidos de su elecci\u00f3n.\r\n"}], "lastModified": "2024-02-14T17:22:38.827", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:windows_phone_7_firmware:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "530B4DD8-07A0-46B8-8E68-EFCE29A895F1"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:microsoft:windows_phone_7:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "368E0B07-BD7D-44CB-BC13-450E2CF0D46D"}], "operator": "OR"}], "operator": "AND"}], "evaluatorImpact": "Per http://www.kb.cert.org/vuls/id/389795 \"A remote attacker with the ability to pose as a man-in-the-middle may be able to view the login or session data in the corresponding protocol (e.g., SMTP, POP3, etc.).\"", "sourceIdentifier": "cret@cert.org"}