{"vuid":"VU#811384","idnumber":"811384","name":"Apple Mac OS X Security Framework Online Certificate Status Protocol (OCSP) service fails to properly retrieve certificate revocation lists","keywords":["Apple","Mac","OS X","Security Framework","Online Certificate Status Protocol","OCSP","certificate revocation lists","HTTP proxy","apple-2006-007"],"overview":"Apple Mac OS X Security Framework Online Certificate Status Protocol (OCSP) service is unable to retrieve certificate revocation lists on systems that are configured to use an HTTP proxy. This vulnerability may result in the use of revoked certificates.","clean_desc":"The Online Certificate Status Protocol (OCSP) is used to obtain the status of X.509 digital certificates. According to Apple Security Update 2006-007: On systems that are configured to use an HTTP proxy, the Online Certificate Status Protocol (OCSP) service is unable to retrieve certificate revocation lists. This update addresses this issue by using the system proxy settings in ocpsd.","impact":"This vulnerability may result in the use of revoked certificates. The full impact of this vulnerability depends on the application verifying the certificate.","resolution":"Apply Apple Updates\nThis issue is addressed by Apple Security Update 2006-007.","workarounds":"","sysaffected":"","thanks":"This issue was reported in Apple Security Update \n2006-007\n. Apple credits Timothy J. Miller of the MITRE Corporation for reporting this issue.","author":"This document was written by Chris Taschner.","public":["http://docs.info.apple.com/article.html?artnum=304829","http://secunia.com/advisories/23155/"],"cveids":["CVE-2006-4409"],"certadvisory":"","uscerttechnicalalert":null,"datecreated":"2006-11-29T14:04:53Z","publicdate":"2006-11-28T00:00:00Z","datefirstpublished":"2006-12-04T14:17:13Z","dateupdated":"2006-12-04T14:17:26Z","revision":11,"vrda_d1_directreport":"0","vrda_d1_population":"2","vrda_d1_impact":"2","cam_widelyknown":"15","cam_exploitation":"0","cam_internetinfrastructure":"7","cam_population":"15","cam_impact":"3","cam_easeofexploitation":"4","cam_attackeraccessrequired":"3","cam_scorecurrent":"0.22275","cam_scorecurrentwidelyknown":"0.273375","cam_scorecurrentwidelyknownexploited":"0.475875","ipprotocol":"","cvss_accessvector":"","cvss_accesscomplexity":"","cvss_authentication":null,"cvss_confidentialityimpact":"","cvss_integrityimpact":"","cvss_availabilityimpact":"","cvss_exploitablity":null,"cvss_remediationlevel":"","cvss_reportconfidence":"","cvss_collateraldamagepotential":"","cvss_targetdistribution":"","cvss_securityrequirementscr":"","cvss_securityrequirementsir":"","cvss_securityrequirementsar":"","cvss_basescore":"","cvss_basevector":"","cvss_temporalscore":"","cvss_environmentalscore":"","cvss_environmentalvector":"","metric":0.22275,"vulnote":null}