Ubuntu 'ubuntuone-client' Package SSL Certificate Validation Information Disclosure Vulnerability

Bugtraq ID:	53828
Class:	Design Error
CVE:	CVE-2011-4409
Remote:	Yes
Local:	No
Published:	Jun 06 2012 12:00AM
Updated:	Jun 06 2012 12:00AM
Credit:	The vendor reported this issue.
Vulnerable:	Ubuntu ubuntuone-client 0 Ubuntu Ubuntu Linux 12.04 LTS i386 Ubuntu Ubuntu Linux 12.04 LTS amd64 Ubuntu Ubuntu Linux 11.10 i386 Ubuntu Ubuntu Linux 11.10 amd64 Ubuntu Ubuntu Linux 11.04 powerpc Ubuntu Ubuntu Linux 11.04 i386 Ubuntu Ubuntu Linux 11.04 ARM Ubuntu Ubuntu Linux 11.04 amd64 Ubuntu Ubuntu Linux 10.04 sparc Ubuntu Ubuntu Linux 10.04 powerpc Ubuntu Ubuntu Linux 10.04 i386 Ubuntu Ubuntu Linux 10.04 ARM Ubuntu Ubuntu Linux 10.04 amd64
Not Vulnerable:

Ubuntu 'ubuntuone-client' Package SSL Certificate Validation Information Disclosure Vulnerability

Ubuntu 'ubuntuone-client' package is prone to an information disclosure vulnerability.

An attacker can exploit this issue through man-in-the-middle attacks by impersonating a trusted server. This may allow the attacker to obtain or modify sensitive information. Information harvested may aid in further attacks.

Ubuntu 'ubuntuone-client' Package SSL Certificate Validation Information Disclosure Vulnerability

An attacker can use readily available network utilities to exploit this issue.

Ubuntu 'ubuntuone-client' Package SSL Certificate Validation Information Disclosure Vulnerability

Solution:
Updates are available. Please see the references for more information.

Ubuntu 'ubuntuone-client' Package SSL Certificate Validation Information Disclosure Vulnerability

References:

• Ubuntu One Client Homepage (Ubuntu)
  
• ubuntuone-client doesn't validate ssl certificates (Ubuntu)