CVE-2011-3444

MEDIUM

Description

Address Book in Apple Mac OS X before 10.7.3 automatically switches to unencrypted sessions upon failure of encrypted connections, which allows remote attackers to read CardDAV data by terminating an encrypted connection and then sniffing the network.

References

http://lists.apple.com/archives/security-announce/2012/Feb/msg00000.html

http://support.apple.com/kb/HT5130

Details

Source: MITRE

Published: 2012-02-02

Updated: 2012-02-06

Type: CWE-310

Risk Information

CVSS v2.0

Base Score: 4.3

Vector: (AV:N/AC:M/Au:N/C:P/I:N/A:N)

Impact Score: 2.9

Exploitability Score: 8.6

Severity: MEDIUM