isync CVE-2013-0289 SSL Certificate Verification Information Disclosure Vulnerability

Bugtraq ID:	57423
Class:	Design Error
CVE:	CVE-2013-0289
Remote:	Yes
Local:	No
Published:	Feb 20 2013 12:00AM
Updated:	May 07 2015 05:09PM
Credit:	Christian Schneider
Vulnerable:	isync isync 1.0.5 isync isync 1.0.4 isync isync 0.4 Gentoo Linux
Not Vulnerable:	isync isync 1.0.6

isync CVE-2013-0289 SSL Certificate Verification Information Disclosure Vulnerability

isync is prone to prone to an information-disclosure vulnerability because the application fails to properly verify SSL certificates from a server.

An attacker can exploit this issue through man-in-the-middle attacks by impersonating a trusted server. This may allow the attacker to obtain or modify sensitive information. Information harvested may aid in further attacks.

isync versions 0.4 through 1.0.5 are vulnerable.

isync CVE-2013-0289 SSL Certificate Verification Information Disclosure Vulnerability

An attacker can use readily available network utilities to exploit this issue.

isync CVE-2013-0289 SSL Certificate Verification Information Disclosure Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

isync CVE-2013-0289 SSL Certificate Verification Information Disclosure Vulnerability

References:

• isync 1.0.6 Release (isync)
  
• isync/mbsync security advisory: missing SSL subject verification (Christian Schneider)
  
• isync: free IMAP and MailDir mailbox synchronizer Homepage (isync)
  
• PATCH] fix CVE-2013-0289: add SSL subject verification (isync)