Date: Wed, 24 Apr 2013 15:35:11 +0100 From: Simon McVittie <smcv@...ian.org> To: oss-security@...ts.openwall.com Subject: CVE(-2007-xxxx?) request: telepathy-idle does not check SSL certificates In versions prior to 0.1.15, telepathy-idle, an IRC backend for the Telepathy framework, does not check the server's SSL/TLS certificate for validity. A network intermediary could use this flaw to carry out man-in-the-middle attacks on IRC users. This flaw has existed, and been flagged in the source code, since at least 2007 (the year in which telepathy-idle moved from Sourceforge to freedesktop.org). I don't know whether that means it should get an ID of the form CVE-2007-xxxx? The upcoming version 0.1.15 will fix this vulnerability. Versions 0.1.11 to 0.1.14 (which use GLib for TLS) carried out some cursory checks on the certificate, but did not check that the issuer was a trusted CA, that the identity matched the server's hostname, or that the certificate had not expired. A minimal patch to correct this is to delete the call to g_socket_client_set_tls_validation_flags() (this will make one regression test fail). Versions 0.1.10 and older (which use OpenSSL for TLS) do not have any support for certificate verification at all. Regards, S  https://bugs.freedesktop.org/show_bug.cgi?id=63810  "TODO sometime in the future implement certificate verification"
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ