{"id":"CVE-2009-0152","aliases":["EUVD-2009-0161","GHSA-3g7h-7745-2cmg"],"status":"published","title":"iChat in Apple Mac OS X 10.5 before 10.5.7 disables SSL for AOL Instant Messenger (AIM)...","description":"iChat in Apple Mac OS X 10.5 before 10.5.7 disables SSL for AOL Instant Messenger (AIM) communication in certain circumstances that are inconsistent with the Require SSL setting, which allows remote attackers to obtain sensitive information by sniffing the network.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.02174,"percentile":0.82437,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-312"],"published":"2009-05-13T15:14:00Z","modified":"2026-06-16T23:04:22Z","products":[{"vendor":"apple","product":"mac_os_x"},{"vendor":"apple","product":"mac_os_x_server"}],"references":[{"url":"http://support.apple.com/kb/HT3549","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory"]},{"url":"http://secunia.com/advisories/35074","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Broken Link"]},{"url":"http://lists.apple.com/archives/security-announce/2009/May/msg00002.html","tags":["vendor-advisory","x_refsource_APPLE","x_transferred","Mailing List","Patch","Vendor Advisory"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/50487","tags":["vdb-entry","x_refsource_XF","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"http://www.securityfocus.com/bid/34926","tags":["vdb-entry","x_refsource_BID","x_transferred","Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id?1022212","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.us-cert.gov/cas/techalerts/TA09-133A.html","tags":["third-party-advisory","x_refsource_CERT","x_transferred","Third Party Advisory","US Government Resource"]},{"url":"http://www.vupen.com/english/advisories/2009/1297","tags":["vdb-entry","x_refsource_VUPEN","x_transferred","Broken Link"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2009-0152"},{"url":"https://github.com/advisories/GHSA-3g7h-7745-2cmg"}],"sources":{"cve":[{"id":"CVE-2009-0152","description":"iChat in Apple Mac OS X 10.5 before 10.5.7 disables SSL for AOL Instant Messenger (AIM) communication in certain circumstances that are inconsistent with the Require SSL setting, which allows remote attackers to obtain sensitive information by sniffing the network.","status":"published","published":"2009-05-13T15:14:00Z","modified":"2024-08-07T04:24:17.761Z","updated_at":"2026-11-02T14:33:25.896677Z"}],"euvd":[{"id":"EUVD-2009-0161","description":"iChat in Apple Mac OS X 10.5 before 10.5.7 disables SSL for AOL Instant Messenger (AIM) communication in certain circumstances that are inconsistent with the Require SSL setting, which allows remote attackers to obtain sensitive information by sniffing the network.","status":"published","published":"2009-05-13T15:14:00Z","modified":"2024-08-07T04:24:17Z","updated_at":"2026-11-03T01:39:27.128816Z"}],"ghsa":[{"id":"GHSA-3g7h-7745-2cmg","title":"iChat in Apple Mac OS X 10.5 before 10.5.7 disables SSL for AOL Instant Messenger (AIM)...","description":"iChat in Apple Mac OS X 10.5 before 10.5.7 disables SSL for AOL Instant Messenger (AIM) communication in certain circumstances that are inconsistent with the Require SSL setting, which allows remote attackers to obtain sensitive information by sniffing the network.","status":"published","published":"2022-05-02T03:13:12Z","modified":"2025-04-09T04:10:50Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-312"],"updated_at":"2026-11-02T15:01:00.026247Z"}],"nvd":[{"id":"CVE-2009-0152","description":"iChat in Apple Mac OS X 10.5 before 10.5.7 disables SSL for AOL Instant Messenger (AIM) communication in certain circumstances that are inconsistent with the Require SSL setting, which allows remote attackers to obtain sensitive information by sniffing the network.","status":"published","published":"2009-05-13T15:30:00.327Z","modified":"2026-06-16T23:04:22.423Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-312"],"updated_at":"2026-11-02T14:01:35.136779Z"}]}}