CVE-2009-0152

HighCVSS 7.5/10Last modified Jun 16, 2026

Description

iChat in Apple Mac OS X 10.5 before 10.5.7 disables SSL for AOL Instant Messenger (AIM) communication in certain circumstances that are inconsistent with the Require SSL setting, which allows remote attackers to obtain sensitive information by sniffing the network.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-312

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://lists.apple.com/archives/security-announce/2009/May/msg00002.htmlMailing List, Patch, Vendor Advisory
http://secunia.com/advisories/35074Broken Link
http://support.apple.com/kb/HT3549Patch, Vendor Advisory
http://www.securityfocus.com/bid/34926Broken Link, Third Party Advisory, VDB Entry
http://www.securitytracker.com/id?1022212Broken Link, Third Party Advisory, VDB Entry
http://www.us-cert.gov/cas/techalerts/TA09-133A.htmlThird Party Advisory, US Government Resource
http://www.vupen.com/english/advisories/2009/1297Broken Link
https://exchange.xforce.ibmcloud.com/vulnerabilities/50487Third Party Advisory, VDB Entry
http://lists.apple.com/archives/security-announce/2009/May/msg00002.htmlMailing List, Patch, Vendor Advisory
http://secunia.com/advisories/35074Broken Link
http://support.apple.com/kb/HT3549Patch, Vendor Advisory
http://www.securityfocus.com/bid/34926Broken Link, Third Party Advisory, VDB Entry
http://www.securitytracker.com/id?1022212Broken Link, Third Party Advisory, VDB Entry
http://www.us-cert.gov/cas/techalerts/TA09-133A.htmlThird Party Advisory, US Government Resource
http://www.vupen.com/english/advisories/2009/1297Broken Link
https://exchange.xforce.ibmcloud.com/vulnerabilities/50487Third Party Advisory, VDB Entry

Timeline

Published: May 13, 2009
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2009

CVE-2009-01534.3International Components for Unicode (ICU) 4.0, 3.6, and other 3.x versions, as used in Apple Mac OS X 10.5 before 10.5.7, iPhone OS 1.0 thr CVE-2009-01546.8Heap-based buffer overflow in Apple Type Services (ATS) in Apple Mac OS X 10.4.11 and 10.5 before 10.5.7 allows remote attackers to execute CVE-2009-01556.8Integer underflow in CoreGraphics in Apple Mac OS X 10.5 before 10.5.7, iPhone OS 1.0 through 2.2.1, and iPhone OS for iPod touch 1.1 throug CVE-2009-01564.3Launch Services in Apple Mac OS X 10.4.11 and 10.5 before 10.5.7 allows remote attackers to cause a denial of service (persistent Finder cra CVE-2009-01576.8Heap-based buffer overflow in CFNetwork in Apple Mac OS X 10.5 before 10.5.7 allows remote web servers to execute arbitrary code or cause a CVE-2009-01586.8Stack-based buffer overflow in telnet in Apple Mac OS X 10.4.11 and 10.5 before 10.5.7 allows remote attackers to execute arbitrary code or CVE-2009-01596.8Stack-based buffer overflow in the cookedprint function in ntpq/ntpq.c in ntpq in NTP before 4.2.4p7-RC2 allows remote NTP servers to execut CVE-2009-01606.8QuickDraw Manager in Apple Mac OS X 10.4.11 and 10.5 before 10.5.7 allows remote attackers to execute arbitrary code or cause a denial of se CVE-2009-01616.4The OpenSSL::OCSP module for Ruby in Apple Mac OS X 10.5 before 10.5.7 misinterprets an unspecified invalid response as a successful OCSP ce CVE-2009-01624.3Cross-site scripting (XSS) vulnerability in Safari before 3.2.3, and 4 Public Beta, on Apple Mac OS X 10.5 before 10.5.7 and Windows allows CVE-2009-01636.8Integer overflow in the TIFF image decoding routines in CUPS 1.3.9 and earlier allows remote attackers to cause a denial of service (daemon CVE-2009-01646.4The web interface for CUPS before 1.3.10 does not validate the HTTP Host header in a client request, which makes it easier for remote attack