CVE-2010-1377

CriticalCVSS 9.3/10Last modified Jun 16, 2026

Description

Open Directory in Apple Mac OS X 10.6 before 10.6.4 creates an unencrypted connection upon certain SSL failures, which allows man-in-the-middle attackers to spoof arbitrary network account servers, and possibly execute arbitrary code, via unspecified vectors.

Metrics

CVSS 2.0 9.3/10AV:N/AC:M/Au:N/C:C/I:C/A:C

Weakness enumeration

CWE-310

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://lists.apple.com/archives/security-announce/2010//Jun/msg00001.htmlVendor Advisory
http://secunia.com/advisories/40220Vendor Advisory
http://securitytracker.com/id?1024103
http://support.apple.com/kb/HT4188Patch, Vendor Advisory
http://www.securityfocus.com/bid/40871Patch
http://www.vupen.com/english/advisories/2010/1481Vendor Advisory
http://lists.apple.com/archives/security-announce/2010//Jun/msg00001.htmlVendor Advisory
http://secunia.com/advisories/40220Vendor Advisory
http://securitytracker.com/id?1024103
http://support.apple.com/kb/HT4188Patch, Vendor Advisory
http://www.securityfocus.com/bid/40871Patch
http://www.vupen.com/english/advisories/2010/1481Vendor Advisory

Timeline

Published: Jun 17, 2010
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2010

CVE-2010-13789.8OpenSSL in Apple Mac OS X 10.6.x before 10.6.5 does not properly perform arithmetic, which allows remote attackers to bypass X.509 certifica CVE-2010-13795.0Printer Setup in Apple Mac OS X 10.6 before 10.6.4 does not properly interpret character encoding, which allows remote attackers to cause a CVE-2010-13807.5Integer overflow in the cgtexttops CUPS filter in Printing in Apple Mac OS X 10.6 before 10.6.4 allows remote attackers to execute arbitrary CVE-2010-13813.5The default configuration of SMB File Server in Apple Mac OS X 10.5.8, and 10.6 before 10.6.4, enables support for wide links, which allows CVE-2010-13823.5Cross-site scripting (XSS) vulnerability in Wiki Server in Apple Mac OS X 10.5.8, and 10.6 before 10.6.4, allows remote authenticated users CVE-2010-13839.3CFNetwork in Apple Safari before 5.0.6 on Windows allows remote web servers to execute arbitrary code by replaying the NTLM credentials of a CVE-2010-13844.3Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1 on Mac OS X 10.4, does not provide a warning about a (1) h CVE-2010-13859.3Use-after-free vulnerability in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1 on Mac OS X 10.4, allows r CVE-2010-138610.0page/Geolocation.cpp in WebCore in WebKit before r56188 and before 1.2.5 does not properly restrict access to the lastPosition function, whi CVE-2010-13879.3Use-after-free vulnerability in JavaScriptCore in WebKit in Apple iTunes before 9.2 on Windows, and Apple iOS before 4 on the iPhone and iPo CVE-2010-13884.3WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6, and before 4.1 on Mac OS X 10.4, does not properly handle clipboard (1) dra CVE-2010-13894.3Cross-site scripting (XSS) vulnerability in WebKit in Apple Safari before 5.0 on Mac OS X 10.5 through 10.6 and Windows, and before 4.1 on M