Gizmo5 for Linux MSN Authentication SSL Certificate Validation Security Bypass Vulnerability

Bugtraq ID:	35508
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Jun 26 2009 12:00AM
Updated:	Jun 29 2009 04:29PM
Credit:	Gabriel Menezes Nunes
Vulnerable:	Gizmo5 Gizmo5 for Linux 3.1 .79
Not Vulnerable:

Gizmo5 for Linux MSN Authentication SSL Certificate Validation Security Bypass Vulnerability

Gizmo5 for Linux is prone to a security-bypass vulnerability because the application fails to properly validate SSL certificates from a server.

Successfully exploiting this issue allows attackers to perform man-in-the-middle attacks or impersonate trusted servers, which will aid in further attacks.

Gizmo5 3.1.0.79 for Linux is vulnerable; other versions may also be affected.

Gizmo5 for Linux MSN Authentication SSL Certificate Validation Security Bypass Vulnerability

An attacker can use readily available network utilities to exploit this issue.

Gizmo5 for Linux MSN Authentication SSL Certificate Validation Security Bypass Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Gizmo5 for Linux MSN Authentication SSL Certificate Validation Security Bypass Vulnerability

References:

• Gizmo5 for Linux Homepage (Gizmo5)
  
• Gizmo SSL Certificate Vulnerability (Gabriel Menezes Nunes )