The IO::Socket::SSL module 1.35 for Perl, when verify_mode is not VERIFY_NONE, fails open to VERIFY_NONE instead of throwing an error when a ca_file/ca_path cannot be verified, which allows remote attackers to bypass intended certificate restrictions.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The IO::Socket::SSL module 1.35 for Perl, when verify_mode is not VERIFY_NONE, fails open to VERIFY_NONE     instead of throwing an error when a ca_file/ca_path cannot be verified, which allows remote attackers to     bypass intended certificate restrictions. (CVE-2010-4334)

Note that Nessus relies on the presence of the package as reported by the vendor.

A vulnerability has been found and corrected in perl-IO-Socket-SSL :

IO::Socket::SSL Perl module 1.35, when verify_mode is not VERIFY_NONE, fails open to VERIFY_NONE instead of throwing an error when a ca_file/ca_path cannot be verified, which allows remote attackers to bypass intended certificate restrictions (CVE-2010-4334).

The updated packages have been patched to correct this issue.

This update fixes a problem whereby IO::Socket::SSL fell back to the 'VERIFY_NONE' verification mode if another verification mode was defined but no valid ca_file or ca_path was provided.

The updated version throws an error in that situation rather than proceeding with the connection despite being unable to verify the certificate(s) as requested.

This issue was originally reported at http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=606058

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
217421	Linux Distros Unpatched Vulnerability : CVE-2010-4334	Nessus	Misc.	high
54578	Mandriva Linux Security Advisory : perl-IO-Socket-SSL (MDVSA-2011:092)	Nessus	Mandriva Local Security Checks	medium
51383	Fedora 14 : perl-IO-Socket-SSL-1.37-1.fc14 (2010-19058)	Nessus	Fedora Local Security Checks	medium
51381	Fedora 13 : perl-IO-Socket-SSL-1.37-1.fc13 (2010-19054)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2010-4334

high

Tenable Plugins

high

medium

medium

medium