CVEvulnerability

CVE-2009-0152

7.5 HIGH Published 2009-05-13 Modified 2026-06-16 Official page ↗

Status: Modified
Published: 2009-05-13
Last modified: 2026-06-16
Assigner: [email protected]
CVSS 3.1 ([email protected]): 7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0 ([email protected]): 5.0 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:N
Weaknesses: CWE-312

Description

iChat in Apple Mac OS X 10.5 before 10.5.7 disables SSL for AOL Instant Messenger (AIM) communication in certain circumstances that are inconsistent with the Require SSL setting, which allows remote attackers to obtain sensitive information by sniffing the network.

Affected configurations

• apple mac os x (>= 10.5.0 < 10.5.7) • apple mac os x server (>= 10.5.0 < 10.5.7)

Weakness · CWE (1)

CWE-312 Cleartext Storage of Sensitive Information weakness

Referenced by CWE · observed example (2)

CWE-311 Missing Encryption of Sensitive Data weakness
CWE-312 Cleartext Storage of Sensitive Information weakness

References

http://lists.apple.com/archives/security-announce/2009/May/msg00002.html Mailing List, Patch, Vendor Advisory
http://secunia.com/advisories/35074 Broken Link
http://support.apple.com/kb/HT3549 Patch, Vendor Advisory
http://www.securityfocus.com/bid/34926 Broken Link, Third Party Advisory, VDB Entry
http://www.securitytracker.com/id?1022212 Broken Link, Third Party Advisory, VDB Entry
http://www.us-cert.gov/cas/techalerts/TA09-133A.html Third Party Advisory, US Government Resource
http://www.vupen.com/english/advisories/2009/1297 Broken Link
https://exchange.xforce.ibmcloud.com/vulnerabilities/50487 Third Party Advisory, VDB Entry
http://lists.apple.com/archives/security-announce/2009/May/msg00002.html Mailing List, Patch, Vendor Advisory
http://secunia.com/advisories/35074 Broken Link
http://support.apple.com/kb/HT3549 Patch, Vendor Advisory
http://www.securityfocus.com/bid/34926 Broken Link, Third Party Advisory, VDB Entry
http://www.securitytracker.com/id?1022212 Broken Link, Third Party Advisory, VDB Entry
http://www.us-cert.gov/cas/techalerts/TA09-133A.html Third Party Advisory, US Government Resource
http://www.vupen.com/english/advisories/2009/1297 Broken Link
https://exchange.xforce.ibmcloud.com/vulnerabilities/50487 Third Party Advisory, VDB Entry