PT-2013-2182 · Gnome · Gnome Online Accounts

Published 2013-03-28 · Updated 2013-04-02 · CVE-2013-0240

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Gnome Online Accounts (GOA) versions 3.4.x through 3.7.x before 3.7.5 Gnome Online Accounts (GOA) versions 3.6.x before 3.6.3

Description The issue allows man-in-the-middle attackers to obtain sensitive information, such as credentials, by sniffing the network. This is due to the improper validation of SSL certificates when creating accounts.

Recommendations For Gnome Online Accounts (GOA) versions 3.4.x, update to version 3.7.5 or later to resolve the issue. For Gnome Online Accounts (GOA) versions 3.6.x before 3.6.3, update to version 3.6.3 or later to resolve the issue. As a temporary workaround, consider disabling the creation of new online accounts until a patch is available.

Fix

Weakness Enumeration

CWE-310

Related Identifiers

CVE-2013-0240

OPENSUSE-SU-2024:10398-1

Affected Products

Gnome Online Accounts

References · 14

• https://osv.dev/vulnerability/DEBIAN-CVE-2013-0240 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-0240 · Security Note
• https://osv.dev/vulnerability/CVE-2013-0240 · Vendor Advisory
• http://secunia.com/advisories/51976 · Vendor Advisory
• http://secunia.com/advisories/52791 · Vendor Advisory
• http://ubuntu.com/usn/usn-1779-1 · Vendor Advisory
• http://lists.opensuse.org/opensuse-updates/2013-02/msg00046.html · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2013-0240 · Vendor Advisory
• https://git.gnome.org/browse/gnome-online-accounts/commit/?h=gnome-3-6&id=ecad8142e9ac519b9fc74b96dcb5531052bbffe1 · Note
• https://git.gnome.org/browse/gnome-online-accounts/commit/?id=edde7c63326242a60a075341d3fea0be0bc4d80e · Note
• https://bugzilla.gnome.org/show_bug.cgi?id=693214 · Note
• https://mail.gnome.org/archives/gnome-announce-list/2013-March/msg00007.html · Note
• https://git.gnome.org/browse/gnome-online-accounts/commit/?id=bc10fdb68f75f8be84eb698ada08743b9c7c248f · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=894352 · Note