CVEs-PoC/2013/CVE-2013-0289.md

CVE-2013-0289

Description

Isync 0.4 before 1.0.6, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

POC

Reference

• http://sourceforge.net/p/isync/isync/ci/914ede18664980925628a9ed2a73ad05f85aeedb
• http://sourceforge.net/projects/isync/files/isync/1.0.6/

Github

No PoCs found on GitHub currently.