GNOME Epiphany Insufficient Invalid SSL Certificate Notification Security Weakness
BID:43296
Info
GNOME Epiphany Insufficient Invalid SSL Certificate Notification Security Weakness
| Bugtraq ID: | 43296 |
| Class: | Design Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Aug 07 2010 12:00AM |
| Updated: | Aug 07 2010 12:00AM |
| Credit: | Sam Morris |
| Vulnerable: |
GNOME Epiphany 2.30.2 GNOME Epiphany 2.29.91 GNOME Epiphany 2.28 |
| Not Vulnerable: | |
Discussion
GNOME Epiphany Insufficient Invalid SSL Certificate Notification Security Weakness
GNOME Epiphany is prone to a security weakness because it fails to sufficiently report if an SSL certificate is invalid.
Legitimate users may feel a false sense of security, which can allow attackers to exploit this weakness to masquerade as a legitimate server using a man-in-the-middle attack or to launch other attacks such as phishing.
GNOME Epiphany is prone to a security weakness because it fails to sufficiently report if an SSL certificate is invalid.
Legitimate users may feel a false sense of security, which can allow attackers to exploit this weakness to masquerade as a legitimate server using a man-in-the-middle attack or to launch other attacks such as phishing.
Exploit / POC
GNOME Epiphany Insufficient Invalid SSL Certificate Notification Security Weakness
An attacker can use readily available tools to carry out this attack.
An attacker can use readily available tools to carry out this attack.
Solution / Fix
GNOME Epiphany Insufficient Invalid SSL Certificate Notification Security Weakness
Solution:
Updates are available. Please see the references for more information.
Solution:
Updates are available. Please see the references for more information.
References
GNOME Epiphany Insufficient Invalid SSL Certificate Notification Security Weakness
References:
References:
- #564690 epiphany-browser - Does not longer check certificates (Bastian Blank)
- Bug 600663 - Certificates not verified (Sam Morris)
- Gnome Epiphany Homepage (GNOME)
- Screenshot (Fefes Blog)