CVE-2014-0350 The Poco::Net::X509Certificate::verify method in the NetSSL library in POCO C++ Libraries before 1.4.6p4 allows man-in-the-middle attackers to spoof SSL servers via crafted DNS PTR records that are re...
MediumCVSS 6.4
EPSS 1.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The Poco::Net::X509Certificate::verify method in the NetSSL library in POCO C++ Libraries before 1.4.6p4 allows man-in-the-middle attackers to spoof SSL servers via crafted DNS PTR records that are requested during comparison of a server name to a wildcard domain name in an X.509 certificate.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/poco(Debian:12) | < 1.3.6p1-5 | 1.3.6p1-5 |
| debian/poco(Debian:13) | < 1.3.6p1-5 | 1.3.6p1-5 |
| debian/poco(Debian:14) | < 1.3.6p1-5 | 1.3.6p1-5 |
| pocoproject poco c++ libraries | <= 1.4.6 | No fix listed |
| pocoproject poco c++ libraries | = 1.4.5 | No fix listed |
| pocoproject poco c++ libraries | = 1.4.6 | No fix listed |
| pocoproject poco c++ libraries | = 1.4.6-p1 | No fix listed |
| pocoproject poco c++ libraries | = 1.4.6-p2 | No fix listed |
References
- Debian Security Tracker CVE-2014-0350 vendor-advisory
- FEDORA-2016-0b3a611401 vendor-advisory
- FEDORA-2016-4a3e5618eb vendor-advisory
- VU#118748 third-party-advisory us-government-resource
- raw.githubusercontent.com
- bugs.debian.org issue-tracking