oss-security - CVE(-2007-xxxx?) request: telepathy-idle does not check SSL certificates

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Wed, 24 Apr 2013 15:35:11 +0100
From: Simon McVittie <smcv@...ian.org>
To: oss-security@...ts.openwall.com
Subject: CVE(-2007-xxxx?) request: telepathy-idle does not check SSL certificates

In versions prior to 0.1.15, telepathy-idle, an IRC backend for the
Telepathy framework, does not check the server's SSL/TLS certificate for
validity[1]. A network intermediary could use this flaw to carry out
man-in-the-middle attacks on IRC users.

This flaw has existed, and been flagged in the source code[2], since at
least 2007 (the year in which telepathy-idle moved from Sourceforge to
freedesktop.org). I don't know whether that means it should get an ID of
the form CVE-2007-xxxx?

The upcoming version 0.1.15 will fix this vulnerability.

Versions 0.1.11 to 0.1.14 (which use GLib for TLS) carried out some
cursory checks on the certificate, but did not check that the issuer was
a trusted CA, that the identity matched the server's hostname, or that
the certificate had not expired. A minimal patch to correct this is to
delete the call to g_socket_client_set_tls_validation_flags() (this will
make one regression test fail).

Versions 0.1.10 and older (which use OpenSSL for TLS) do not have any
support for certificate verification at all.

Regards,
    S

[1] https://bugs.freedesktop.org/show_bug.cgi?id=63810
[2] "TODO sometime in the future implement certificate verification"

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.