PT-2011-3123 · Weechat · Weechat

Gu1 · Published 2011-03-16 · Updated 2011-03-22 · CVE-2011-1428

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Wee Enhanced Environment for Chat (aka WeeChat) versions 0.3.4 and earlier

Description The issue arises from improper verification that the server hostname matches the domain name of the subject of an X.509 certificate. This allows man-in-the-middle attackers to spoof an SSL chat server via an arbitrary certificate, due to incorrect use of the GnuTLS API.

Recommendations For Wee Enhanced Environment for Chat (aka WeeChat) versions 0.3.4 and earlier, update to a version that properly verifies the server hostname against the domain name of the X.509 certificate subject.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2011-1428

DSA-2598-1

Affected Products

Weechat

References · 12

• 🔥 http://savannah.nongnu.org/patch/index.php?7459 · Exploit
• 🔥 http://archives.neohapsis.com/archives/fulldisclosure/2011-02/0671.html · Exploit
• https://ubuntu.com/security/CVE-2011-1428 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2011-1428 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2011-1428 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2011-1428 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2011-1428 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2011-1428 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2011-1428 · Vendor Advisory
• http://secunia.com/advisories/43543 · Vendor Advisory
• http://git.savannah.gnu.org/gitweb/?p=weechat.git%3Ba=commit%3Bh=c265cad1c95b84abfd4e8d861f25926ef13b5d91 · Note
• http://securityfocus.com/bid/46612 · Note