PT-2011-3123 · Weechat · Weechat

Gu1 · Publicado 2011-03-16 · Atualizado 2011-03-22 · CVE-2011-1428

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Wee Enhanced Environment for Chat (aka WeeChat) versions 0.3.4 and earlier

Description The issue arises from improper verification that the server hostname matches the domain name of the subject of an X.509 certificate. This allows man-in-the-middle attackers to spoof an SSL chat server via an arbitrary certificate, due to incorrect use of the GnuTLS API.

Recommendations For Wee Enhanced Environment for Chat (aka WeeChat) versions 0.3.4 and earlier, update to a version that properly verifies the server hostname against the domain name of the X.509 certificate subject.

Exploit

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2011-1428

DSA-2598-1

Produtos afetados

Weechat

Referências · 12

• 🔥 http://savannah.nongnu.org/patch/index.php?7459 · Exploit
• 🔥 http://archives.neohapsis.com/archives/fulldisclosure/2011-02/0671.html · Exploit
• https://ubuntu.com/security/CVE-2011-1428 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2011-1428 · Nota de Segurança
• http://git.savannah.gnu.org/gitweb/?p=weechat.git%3Ba=commit%3Bh=c265cad1c95b84abfd4e8d861f25926ef13b5d91 · Nota
• https://security-tracker.debian.org/tracker/CVE-2011-1428 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2011-1428 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2011-1428 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2011-1428 · Nota de Segurança
• https://osv.dev/vulnerability/UBUNTU-CVE-2011-1428 · Aviso do Fabricante
• http://secunia.com/advisories/43543 · Aviso do Fabricante
• http://securityfocus.com/bid/46612 · Nota