QSslSocket in Trolltech Qt 4.3.0 through 4.3.2 does not properly verify SSL certificates, which might make it easier for remote attackers to trick a user into accepting an invalid server certificate for a spoofed service, or trick a service into accepting an invalid client certificate for a user.

A potential vulnerability was discovered in Qt4 version 4.3.0 through 4.3.2 which may cause a certificate verification in SSL connections not to be performed. As a result, code that uses QSslSocket could be tricked into thinking that the certificate was verified correctly when it actually failed in one or more criteria.

The updated packages have been patched to correct this issue.

It was discovered that QSslSocket did not properly verify SSL certificates. A remote attacker may be able to trick applications using QSslSocket into accepting invalid SSL certificates.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A bug in the QSslSocket class could under certain circumstances lead to incorrect SSL certificates beeing accepted as valid (CVE-2007-5965).

An update to the latest upstream release. Includes fix for security issue CVE-2007-5965 (rhbz#411751).

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
38087	Mandriva Linux Security Advisory : qt4 (MDVSA-2008:042)	Nessus	Mandriva Local Security Checks	medium
31164	Ubuntu 7.10 : qt4-x11 vulnerability (USN-579-1)	Nessus	Ubuntu Local Security Checks	medium
30015	openSUSE 10 Security Update : libqt4 (libqt4-4790)	Nessus	SuSE Local Security Checks	medium
29842	Fedora 7 : qt4-4.3.3-1.fc7 (2007-4354)	Nessus	Fedora Local Security Checks	medium
29841	Fedora 8 : qt4-4.3.3-1.fc8 (2007-4285)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2007-5965

medium

Tenable Plugins

medium

medium

medium

medium

medium