PT-2013-3398 · Gnome · Libsoup+1

Debarshi Ray · Publicado 2013-03-28 · Atualizado 2023-02-13 · CVE-2013-1799

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Gnome Online Accounts (GOA) versions 3.6.x through 3.6.2 Gnome Online Accounts (GOA) versions 3.7.x through 3.7.90

Description The issue is related to the improper validation of SSL certificates when creating accounts for providers who use the libsoup library. This allows man-in-the-middle attackers to obtain sensitive information, such as credentials, by sniffing the network.

Recommendations For Gnome Online Accounts (GOA) versions 3.6.x through 3.6.2, update to version 3.6.3 or later. For Gnome Online Accounts (GOA) versions 3.7.x through 3.7.90, update to version 3.7.91 or later.

Correção

Enumeração de Fraquezas

CWE-310

Identificadores relacionados

CVE-2013-1799

Produtos afetados

Gnome Online Accounts

Libsoup

Referências · 10

• http://secunia.com/advisories/52791 · Aviso do Fabricante
• https://bugzilla.gnome.org/show_bug.cgi?id=693214 · Nota
• http://secunia.com/advisories/51976 · Aviso do Fabricante
• https://git.gnome.org/browse/gnome-online-accounts/commit/?id=9cf4bc0ced2c53bcdd36922caa65afc8a167bbd8 · Nota
• https://mail.gnome.org/archives/gnome-announce-list/2013-March/msg00007.html · Nota
• http://ubuntu.com/usn/usn-1779-1 · Aviso do Fabricante
• https://mail.gnome.org/archives/gnome-announce-list/2013-March/msg00020.html · Nota
• https://bugzilla.gnome.org/show_bug.cgi?id=695106 · Nota
• http://lists.opensuse.org/opensuse-updates/2013-02/msg00046.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2013-1799 · Nota de Segurança