Perl IO::Socket::SSL 'verify_mode' Security Bypass Vulnerability

Bugtraq ID:	45189
Class:	Design Error
CVE:	CVE-2010-4334
Remote:	Yes
Local:	No
Published:	Dec 06 2010 12:00AM
Updated:	Apr 13 2015 09:37PM
Credit:	Daniel Kahn Gillmor
Vulnerable:	Mandriva Linux Mandrake 2010.1 x86_64 Mandriva Linux Mandrake 2010.1 CPAN IO::Socket::SSL 1.34 CPAN IO::Socket::SSL 1.26 CPAN IO::Socket::SSL 1.25
Not Vulnerable:	CPAN IO::Socket::SSL 1.35

Perl IO::Socket::SSL 'verify_mode' Security Bypass Vulnerability

The IO::Socket::SSL module for Perl is prone to a security-bypass vulnerability.

Successfully exploiting this issue allows attackers to bypass certain security restrictions, which may aid in spoofing attacks.

Versions prior to IO::Socket::SSL 1.35 are vulnerable.

Perl IO::Socket::SSL 'verify_mode' Security Bypass Vulnerability

An attacker can use readily available network utilities to exploit this issue.

Perl IO::Socket::SSL 'verify_mode' Security Bypass Vulnerability

Solution:
Updates are available. Please see the references for more information.


Mandriva Linux Mandrake 2010.1

• Mandriva perl-IO-Socket-SSL-1.330.0-1.1mdv2010.2.noarch.rpm
  http://www.mandriva.com/en/download/

Mandriva Linux Mandrake 2010.1 x86_64

• Mandriva perl-IO-Socket-SSL-1.330.0-1.1mdv2010.2.noarch.rpm
  http://www.mandriva.com/en/download/

Perl IO::Socket::SSL 'verify_mode' Security Bypass Vulnerability

References:

• libio-socket-ssl-perl: IO::Socket::SSL ignores user request for peer (Debian)
  
• IO-Socket-SSL 1.35 Changelog (CPAN)
  
• IO-Socket-SSL Homepage (CPAN)