libinfinity 'inf-gtk-certificate-manager.c' SSL Certificate Validation Security Bypass Vulnerability

Bugtraq ID:	74594
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Apr 28 2015 12:00AM
Updated:	Apr 28 2015 12:00AM
Credit:	Philipp Kern
Vulnerable:	libinfinity libinfinity 0.5.5 libinfinity libinfinity 0.5.4 libinfinity libinfinity 0.5.3 libinfinity libinfinity 0.5.2 libinfinity libinfinity 0.5.1 Gobby Gobby 0.5
Not Vulnerable:	libinfinity libinfinity 0.6

libinfinity 'inf-gtk-certificate-manager.c' SSL Certificate Validation Security Bypass Vulnerability

libinfinity is prone to a security-bypass vulnerability because it fails to properly validate SSL certificates.

Successfully exploiting this issue allows attackers to perform man-in-the-middle attacks or impersonate trusted servers, which will aid in further attacks.

libinfinity 'inf-gtk-certificate-manager.c' SSL Certificate Validation Security Bypass Vulnerability

An attacker can use readily available network utilities to exploit this issue.

libinfinity 'inf-gtk-certificate-manager.c' SSL Certificate Validation Security Bypass Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

libinfinity 'inf-gtk-certificate-manager.c' SSL Certificate Validation Security Bypass Vulnerability

References:

• Gobby seems to silently accept expired certificates #61 (Gobby)
  
• Fix expired certificate validation (gobby #61) (libinfinity)
  
• gobby silently accepts expired certificates (Debian)
  
• libinfinity Homepage (gobby)