libgdata before 0.10.2 and 0.11.x before 0.11.1 does not validate SSL certificates, which allows remote attackers to obtain user names and passwords via a man-in-the-middle (MITM) attack with a spoofed certificate.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - libgdata: Absent validation of SSL certificates (CVE-2012-1177)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

Changes in libgdata :

  - Add libgdata-validate-ssl-cert.patch: validate SSL     certificates for all connections. Fix bnc#752088,     CVE-2012-1177.

  - Add gnome-common BuildRequires and call     gnome-autogen.sh: needed for above patch.

  - Pass --with-ca-certs=/etc/ssl/ca-bundle.pem to configure     to let libgdata know about the location of our     certificates.

A vulnerability has been discovered and corrected in libgdata :

It was found that previously libgdata, a GLib-based library for accessing online service APIs using the GData protocol, did not perform SSL certificates validation even for secured connections. An application, linked against the libgdata library and holding the trust about the other side of the connection being the valid owner of the certificate, could be tricked into accepting of a spoofed SSL certificate by mistake (MITM attack) (CVE-2012-1177).

The updated packages have been patched to correct this issue.

Vreixo Formoso discovered that the libGData library, as used by Evolution and other applications, did not properly verify SSL certificates. A remote attacker could exploit this to perform a man in the middle attack to view sensitive information or alter data transmitted via the GData protocol.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201208-06 (libgdata: Man-in-the-Middle attack)

    An error in the '_gdata_service_build_session()' function of       gdata-service.c prevents libgdata from properly validating certificates.
  Impact :

    A remote attacker could perform man-in-the-middle attacks to spoof       arbitrary SSL servers via a crafted certificate.
  Workaround :

    There is no known workaround at this time.

Vreixo Formoso discovered that libgdata, a library used to access various Google services, wasn't validating certificates against trusted system root CAs when using an HTTPS connection.

ID	Name	Product	Family	Severity
198329	RHEL 6 : libgdata (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	medium
74676	openSUSE Security Update : libgdata (openSUSE-SU-2012:0862-1)	Nessus	SuSE Local Security Checks	medium
61964	Mandriva Linux Security Advisory : libgdata (MDVSA-2012:111)	Nessus	Mandriva Local Security Checks	medium
61707	Ubuntu 10.04 LTS / 11.04 / 11.10 : libgdata, evolution-data-server vulnerability (USN-1547-1)	Nessus	Ubuntu Local Security Checks	medium
61545	GLSA-201208-06 : libgdata: Man-in-the-Middle attack	Nessus	Gentoo Local Security Checks	medium
59760	Debian DSA-2482-1 : libgdata - insufficient certificate validation	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2012-1177

high

Tenable Plugins

medium

medium

medium

medium

medium

medium