PT-2012-3827 · Gnome+2 · Libsoup+2

Michael Vogt · Publicado 2012-07-12 · Atualizado 2017-08-29 · CVE-2012-2132

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions libsoup versions 2.32.2 and earlier

Description The issue allows remote attackers to bypass authentication by connecting with an SSL connection, as it does not validate certificates or clear the trust flag when the ssl-ca-file does not exist.

Recommendations For versions 2.32.2 and earlier, ensure the ssl-ca-file exists and is properly configured to validate certificates and maintain the trust flag. As a temporary workaround, consider disabling SSL connections until a proper fix is applied.

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2012-2132

SUSE-SU-2012_0870-1

Produtos afetados

Debian

Suse

Libsoup

Referências · 19

• https://lists.suse.com/pipermail/sle-security-updates/2012-July/000178.html · Nota
• https://osv.dev/vulnerability/CVE-2012-2132 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2012/05/02/8 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2012-2132 · Nota de Segurança
• http://lists.suse.com/mailman/listinfo/sle-security-updates · Nota
• https://security-tracker.debian.org/tracker/source-package/midori · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2012/04/24/3 · Nota
• http://openwall.com/lists/oss-security/2012/04/24/13 · Nota
• https://packages.debian.org/src:midori · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2012-2132 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/75167 · Nota
• http://download.novell.com/patch/finder/?keywords=625e36b09557835cd71a8041f2d28e18 · Nota
• https://bugzilla.novell.com/758431 · Nota
• http://securityfocus.com/bid/53232 · Nota
• https://bugzilla.gnome.org/show_bug.cgi?id=666280 · Nota