CVE-2012-2993 in Microsoft Windows Phone

Summary

Microsoft Windows Phone 7 does not verify the domain name in the subject s Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof an SSL server for the (1) POP3, (2) IMAP, or (3) SMTP protocol via an arbitrary valid certificate.

Reservation

05/30/2012

Disclosure

09/17/2012

Entries

VulDB provides additional information and datapoints for this CVE:

ID	Vulnerability	CWE	Exp	Cou	CVE
6525	Microsoft Windows Phone Certificate Subject Common Name cryptographic issue	310	Proof-of-Concept	Unavailable	CVE-2012-2993
4484	Microsoft Windows Phone SMS Service cryptographic issue	310	Proof-of-Concept	Unavailable	CVE-2012-2993