CVE-2011-0199

low-risk
Published 2011-06-24

The Certificate Trust Policy component in Apple Mac OS X before 10.6.8 does not perform CRL checking for Extended Validation (EV) certificates that lack OCSP URLs, which might allow man-in-the-middle attackers to spoof an SSL server via a revoked certificate.

Do I need to act?

-
0.17% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
5
CVSS 5.9/10 Medium
NETWORK / HIGH complexity

Affected Products (2)

Affected Vendors

Apple

References (6)

Mailing List http://lists.apple.com/archives/security-announce/2011//Jun/msg00000.html
Patch http://support.apple.com/kb/HT4723
Broken Link http://www.securityfocus.com/bid/48447
Mailing List http://lists.apple.com/archives/security-announce/2011//Jun/msg00000.html
Patch http://support.apple.com/kb/HT4723
Broken Link http://www.securityfocus.com/bid/48447
26
/ 100
low-risk
Severity 18/34 · Moderate
Exploitability 1/34 · Minimal
Exposure 7/34 · Low