Unscored severity · published Feb 2, 2011
CVE-2011-0738
MyProxy 5.0 through 5.2, as used in Globus Toolkit 5.0.0 through 5.0.2, does not properly verify the (1) hostname or (2) identity in the X.509 certificate for the myproxy-server,…
–
CVSS
1.6%
EPSS
No
On KEV
Description
MyProxy 5.0 through 5.2, as used in Globus Toolkit 5.0.0 through 5.0.2, does not properly verify the (1) hostname or (2) identity in the X.509 certificate for the myproxy-server, which allows remote attackers to spoof the server and conduct man-in-the-middle (MITM) attacks via a crafted certificate when executing (a) myproxy-logon or (b) myproxy-get-delegation.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.6% · higher than 75% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GT
Globus Toolkit · Globus
5.0.0; 5.0.1; 5.0.2 · source: NVD
MY
Myproxy · Ncsa
5.0; 5.1; 5.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2011-0738
CVE.org
https://www.cve.org/CVERecord?id=CVE-2011-0738
Vendor Advisory
http://grid.ncsa.illinois.edu/myproxy/security/myproxy-adv-2011-01.txt
lists.fedoraproject.org
http://lists.fedoraproject.org/pipermail/package-announce/2011-January/053461.html
lists.fedoraproject.org
http://lists.fedoraproject.org/pipermail/package-announce/2011-January/053473.html
Patch
http://lists.globus.org/pipermail/security-announce/2011-January/000018.html
osvdb.org
http://osvdb.org/70494
Vendor Advisory
http://secunia.com/advisories/42972
More from Globus Toolkit
–
CVE-2012-3292
The GridFTP in Globus Toolkit (GT) before 5.2.2, when certain autoconf macros are defined, does not properly check the return value from the getpwnam_r function, which might allow…
–
CVE-2007-2784
Unspecified vulnerability in globus-job-manager in Globus Toolkit 4.1.1 and earlier (globus_nexus-6.6 and earlier) allows remote attackers to cause a denial of service (resource…
–
CVE-2006-4232
Race condition in the grid-proxy-init tool in Globus Toolkit 3.2.x, 4.0.x, and 4.1.0 before 20060815 allows local users to steal credential data by replacing the proxy credentials…
–
CVE-2006-4233
Globus Toolkit 3.2.x, 4.0.x, and 4.1.0 before 20060815 allow local users to obtain sensitive information (proxy certificates) and overwrite arbitrary files via a symlink attack on…