CVE-2011-3253

Related Files

CalDAV SSL Certificate Validation

Posted Oct 13, 2011

Authored by Knud | Site nsense.fi

nSense Vulnerability Research Security Advisory - The calendar synchronization feature of iOS fails to validate the SSL certificate provided by the server. Therefore, CalDAV communication can be intercepted by a basic man in the middle attack. As every request contains a HTTP basic authentication header, which contains base64-encoded credentials, it is possible to intercept email account credentials by an attacker that is suitably positioned (e.g. the same LAN, WLAN) or is able to tamper with DNS records pointing to the CalDAV server. The application accepts the untrusted certificate without any warning or prompt, so the attack will go unnoticed by the user.

tags | advisory, web

systems | cisco

advisories | CVE-2011-3253

SHA-256 | 1287538d9d82e32529c0d747e336f8c5ebf4984b6eb88af17ffa07e9b262328d

Download | Favorite | View