CVE-2011-3444

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2012-02-02 · updated 2026-06-16
Weakness: CWE-310

Description

Address Book in Apple Mac OS X before 10.7.3 automatically switches to unencrypted sessions upon failure of encrypted connections, which allows remote attackers to read CardDAV data by terminating an encrypted connection and then sniffing the network.

Affected products

macOS: through 10.7.2; 10.7.0, 10.7.1
Apple Mac Os X Server: through 10.7.2; 10.7.0, 10.7.1

References

http://lists.apple.com/archives/security-announce/2012/Feb/msg00000.html
http://support.apple.com/kb/HT5130
http://lists.apple.com/archives/security-announce/2012/Feb/msg00000.html
http://support.apple.com/kb/HT5130

Get alerted when CVE-2011-3444 or the next vulnerability affects your stack