CVE-2011-0738 MyProxy 5.0 through 5.2, as used in Globus Toolkit 5.0.0 through 5.0.2, does not properly verify the (1) hostname or (2) identity in the X.509 certificate for the myproxy-server, which allows remote a...
MediumCVSS 4.3
EPSS 1.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
MyProxy 5.0 through 5.2, as used in Globus Toolkit 5.0.0 through 5.0.2, does not properly verify the (1) hostname or (2) identity in the X.509 certificate for the myproxy-server, which allows remote attackers to spoof the server and conduct man-in-the-middle (MITM) attacks via a crafted certificate when executing (a) myproxy-logon or (b) myproxy-get-delegation.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ncsa myproxy | = 5.0 | No fix listed |
| ncsa myproxy | = 5.1 | No fix listed |
| ncsa myproxy | = 5.2 | No fix listed |
| globus toolkit | = 5.0.0 | No fix listed |
| globus toolkit | = 5.0.1 | No fix listed |
| globus toolkit | = 5.0.2 | No fix listed |
References
- grid.ncsa.illinois.edu vendor-advisory
- FEDORA-2011-0514 vendor-advisory
- FEDORA-2011-0512 vendor-advisory
- [security-announce] 20110118 Globus Security Advisory 2011-01: myproxy-logon identity checking of server mailing-list patch
- 70494 vdb-entry
- 42972 third-party-advisory vendor-advisory
- 43103 third-party-advisory vendor-advisory
- 45916 vdb-entry
- ADV-2011-0227 vdb-entry
- myproxy-ssl-spoofing(64830) vdb-entry