A vulnerability was found in AFNetworking Framework up to 2.5.2. It has been rated as critical. Affected by this issue is an unknown code block of the component Configuration Handler. The manipulation of the argument AFSecurityPolicy.validatesDomainName with an unknown input leads to a 7pk security vulnerability. Using CWE to declare the problem leads to CWE-254. Impacted is confidentiality, integrity, and availability. CVE summarizes:

The default AFSecurityPolicy.validatesDomainName configuration for AFSSLPinningModeNone in the AFNetworking framework before 2.5.3, as used in the ownCloud iOS Library, disables verification of a server hostname against the domain name in the subject's Common Name (CN) of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

The weakness was disclosed 10/27/2015 (Website). The advisory is available at owncloud.org. This vulnerability is handled as CVE-2015-3996 since 05/15/2015. The exploitation is known to be difficult. The attack may be launched remotely. No form of authentication is required for exploitation. Technical details are known, but there is no available exploit. This vulnerability is assigned to T1211 by the MITRE ATT&CK project.

Upgrading to version 2.5.3 eliminates this vulnerability.

Affected

• AFNetworking Framework
• ownCloud iOS Library

Productinfo

Vendor

• AFNetworking

Name

• Framework

Version

• 2.5.0
• 2.5.1
• 2.5.2

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion