PT-2013-2182 · Gnome · Gnome Online Accounts

Publicado 2013-03-28 · Atualizado 2013-04-02 · CVE-2013-0240

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Gnome Online Accounts (GOA) versions 3.4.x through 3.7.x before 3.7.5 Gnome Online Accounts (GOA) versions 3.6.x before 3.6.3

Description The issue allows man-in-the-middle attackers to obtain sensitive information, such as credentials, by sniffing the network. This is due to the improper validation of SSL certificates when creating accounts.

Recommendations For Gnome Online Accounts (GOA) versions 3.4.x, update to version 3.7.5 or later to resolve the issue. For Gnome Online Accounts (GOA) versions 3.6.x before 3.6.3, update to version 3.6.3 or later to resolve the issue. As a temporary workaround, consider disabling the creation of new online accounts until a patch is available.

Correção

Enumeração de Fraquezas

CWE-310

Identificadores relacionados

CVE-2013-0240

OPENSUSE-SU-2024:10398-1

Produtos afetados

Gnome Online Accounts

Referências · 14

• https://osv.dev/vulnerability/DEBIAN-CVE-2013-0240 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2013-0240 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2013-0240 · Aviso do Fabricante
• http://secunia.com/advisories/51976 · Aviso do Fabricante
• https://git.gnome.org/browse/gnome-online-accounts/commit/?h=gnome-3-6&id=ecad8142e9ac519b9fc74b96dcb5531052bbffe1 · Nota
• https://git.gnome.org/browse/gnome-online-accounts/commit/?id=edde7c63326242a60a075341d3fea0be0bc4d80e · Nota
• https://bugzilla.gnome.org/show_bug.cgi?id=693214 · Nota
• https://mail.gnome.org/archives/gnome-announce-list/2013-March/msg00007.html · Nota
• http://secunia.com/advisories/52791 · Aviso do Fabricante
• https://git.gnome.org/browse/gnome-online-accounts/commit/?id=bc10fdb68f75f8be84eb698ada08743b9c7c248f · Nota
• https://bugzilla.redhat.com/show_bug.cgi?id=894352 · Nota
• http://ubuntu.com/usn/usn-1779-1 · Aviso do Fabricante
• http://lists.opensuse.org/opensuse-updates/2013-02/msg00046.html · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2013-0240 · Aviso do Fabricante