CVE-2011-3444

Address Book in Apple Mac OS X before 10.7.3 automatically switches to unencrypted sessions upon failure of encrypted connections, which allows remote attackers to read CardDAV data by terminating an encrypted connection and then sniffing the network.

Score

CVSS 2.0 4.3 Medium

Status

Modified - product-security@apple.com

Published

2012-02-02

Last modified

2024-09-17

Weaknesses

CWE-310

Affected products

• Mac Os X (Apple)
• Mac Os X Server (Apple)

References

• http://lists.apple.com/archives/security-announce/2012/Feb/msg00000.html
• http://support.apple.com/kb/HT5130