CVE-2015-5824

Severity Score

4.3

*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

The NSURL implementation in the CFNetwork SSL component in Apple iOS before 9 does not properly verify X.509 certificates from SSL servers after a certificate change, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

Vulnerabilidad en la implementación de NSURL en el componente CFNetwork SSL en Apple iOS en versiones anteriores a 9, no verifica adecuadamente los certificados X.509 de los servidores SSL después un cambio en el certificado, lo que permite a atacantes man-in-the-middle suplantar los servidores y obtener información sensible a través de un certificado manipulado.

*Credits: N/A

CVSS Scores

NISTv2 4.3

Attack Vector

Adjacent

Attack Complexity

Medium

Authentication

None

Confidentiality

Partial

Integrity

Partial

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2015-08-06 CVE Reserved
2015-09-18 CVE Published
2023-03-08 EPSS Updated
2024-08-06 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-310: Cryptographic Issues

CAPEC

References (8)

URL	Tag	Source
http://www.securityfocus.com/bid/76764	Vdb Entry
http://www.securitytracker.com/id/1033609	Vdb Entry
https://support.apple.com/HT205213	X_refsource_confirm
https://support.apple.com/HT205267	X_refsource_confirm

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC
http://lists.apple.com/archives/security-announce/2015/Sep/msg00001.html	2016-12-22
http://lists.apple.com/archives/security-announce/2015/Sep/msg00005.html	2016-12-22
http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html	2016-12-22
https://support.apple.com/HT205212	2016-12-22

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Apple Search vendor "Apple"		Watchos Search vendor "Apple" for product "Watchos"				1.0 Search vendor "Apple" for product "Watchos" and version "1.0"		-		Affected
Apple Search vendor "Apple"		Mac Os X Search vendor "Apple" for product "Mac Os X"				<= 10.10.5 Search vendor "Apple" for product "Mac Os X" and version " <= 10.10.5"		-		Affected
Apple Search vendor "Apple"		Iphone Os Search vendor "Apple" for product "Iphone Os"				<= 8.4.1 Search vendor "Apple" for product "Iphone Os" and version " <= 8.4.1"		-		Affected