Executive Summary
| Informations | |||
|---|---|---|---|
| Name | CVE-2009-0152 | First vendor Publication | 2009-05-13 |
| Vendor | Cve | Last vendor Modification | 2024-02-14 |
Security-Database Scoring CVSS v3
| Cvss vector : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | |||
|---|---|---|---|
| Overall CVSS Score | 7.5 | ||
| Base Score | 7.5 | Environmental Score | 7.5 |
| impact SubScore | 3.6 | Temporal Score | 7.5 |
| Exploitabality Sub Score | 3.9 | ||
| Attack Vector | Network | Attack Complexity | Low |
| Privileges Required | None | User Interaction | None |
| Scope | Unchanged | Confidentiality Impact | High |
| Integrity Impact | None | Availability Impact | None |
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:N/AC:L/Au:N/C:P/I:N/A:N) | |||
|---|---|---|---|
| Cvss Base Score | 5 | Attack Range | Network |
| Cvss Impact Score | 2.9 | Attack Complexity | Low |
| Cvss Expoit Score | 10 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| iChat in Apple Mac OS X 10.5 before 10.5.7 disables SSL for AOL Instant Messenger (AIM) communication in certain circumstances that are inconsistent with the Require SSL setting, which allows remote attackers to obtain sensitive information by sniffing the network. |
Original Source
| Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0152 |
CAPEC : Common Attack Pattern Enumeration & Classification
| Id | Name |
|---|---|
| CAPEC-31 | Accessing/Intercepting/Modifying HTTP Cookies |
| CAPEC-37 | Lifting Data Embedded in Client Distributions |
| CAPEC-65 | Passively Sniff and Capture Application Code Bound for Authorized Client |
| CAPEC-117 | Data Interception Attacks |
| CAPEC-155 | Screen Temporary Files for Sensitive Information |
| CAPEC-157 | Sniffing Attacks |
| CAPEC-167 | Lifting Sensitive Data from the Client |
| CAPEC-204 | Lifting cached, sensitive data embedded in client distributions (thick or thin) |
| CAPEC-205 | Lifting credential(s)/key material embedded in client distributions (thick or... |
| CAPEC-258 | Passively Sniffing and Capturing Application Code Bound for an Authorized Cli... |
| CAPEC-259 | Passively Sniffing and Capturing Application Code Bound for an Authorized Cli... |
| CAPEC-260 | Passively Sniffing and Capturing Application Code Bound for an Authorized Cli... |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 100 % | CWE-312 | Cleartext Storage of Sensitive Information |
CPE : Common Platform Enumeration
OpenVAS Exploits
| Date | Description |
|---|---|
| 2010-05-12 | Name : Mac OS X 10.5.7 Update / Mac OS X Security Update 2009-002 File : nvt/macosx_upd_10_5_7_secupd_2009-002.nasl |
| 2009-11-17 | Name : Mac OS X Version File : nvt/macosx_version.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 54448 | Apple Mac OS X iChat SSL for AOL Instant Messenger (AIM) Encryption Disable W... |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2012-01-04 | Name : The remote server is affected by a signature validation bypass vulnerability. File : openssl_0_9_8j.nasl - Type : ACT_GATHER_INFO |
| 2009-05-13 | Name : The remote host is missing a Mac OS X update that fixes various security issues. File : macosx_10_5_7.nasl - Type : ACT_GATHER_INFO |
Sources (Detail)
Alert History
| Date | Informations |
|---|---|
| 2024-02-14 21:28:18 |
|
| 2021-05-04 12:09:01 |
|
| 2021-04-22 01:09:21 |
|
| 2020-05-23 00:23:13 |
|
| 2017-08-08 09:24:39 |
|
| 2016-04-26 18:33:41 |
|
| 2014-02-17 10:48:23 |
|
| 2013-05-10 23:42:16 |
|
