Perl libwww-perl (LWP) Module SSL Certificate Validation Security Bypass Vulnerability

Bugtraq ID:	47895
Class:	Design Error
CVE:	CVE-2011-0633
Remote:	Yes
Local:	No
Published:	May 18 2011 12:00AM
Updated:	Feb 05 2014 12:54AM
Credit:	aaron
Vulnerable:	Gentoo Linux CPAN Perl libwww-perl 5.837
Not Vulnerable:	CPAN Perl libwww-perl 6.00

Perl libwww-perl (LWP) Module SSL Certificate Validation Security Bypass Vulnerability

The 'libwww-perl' module for Perl is prone to a security-bypass vulnerability because the application fails to properly validate SSL certificates from a server.

Successfully exploiting this issue allows attackers to perform man-in-the-middle attacks or impersonate trusted servers, which will aid in further attacks.

libwww-perl versions prior to 6.00 are vulnerable.

Perl libwww-perl (LWP) Module SSL Certificate Validation Security Bypass Vulnerability

An attacker can use readily available network utilities to exploit this issue.

Perl libwww-perl (LWP) Module SSL Certificate Validation Security Bypass Vulnerability

Solution:
Updates are available. Please see the references for more details.

Perl libwww-perl (LWP) Module SSL Certificate Validation Security Bypass Vulnerability

References:

• Man-in-the-middle fun with Perl LWP (vtty)
  
• Perl libwww-perl (LWP) Release 6.00 (Perl.org)
  
• Product Homepage (CPAN)