libgdata before 0.10.2 and 0.11.x before 0.11.1 does not validate SSL certificates, which allows remote attackers to obtain user names and passwords via a man-in-the-middle (MITM) attack with a spoofed certificate.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - libgdata before 0.10.2 and 0.11.x before 0.11.1 does not validate SSL certificates, which allows remote     attackers to obtain user names and passwords via a man-in-the-middle (MITM) attack with a spoofed     certificate. (CVE-2012-1177)

Note that Nessus relies on the presence of the package as reported by the vendor.

Changes in libgdata :

  - Add libgdata-validate-ssl-cert.patch: validate SSL     certificates for all connections. Fix bnc#752088,     CVE-2012-1177.

  - Add gnome-common BuildRequires and call     gnome-autogen.sh: needed for above patch.

  - Pass --with-ca-certs=/etc/ssl/ca-bundle.pem to configure     to let libgdata know about the location of our     certificates.

A vulnerability has been discovered and corrected in libgdata :

It was found that previously libgdata, a GLib-based library for accessing online service APIs using the GData protocol, did not perform SSL certificates validation even for secured connections. An application, linked against the libgdata library and holding the trust about the other side of the connection being the valid owner of the certificate, could be tricked into accepting of a spoofed SSL certificate by mistake (MITM attack) (CVE-2012-1177).

The updated packages have been patched to correct this issue.

Vreixo Formoso discovered that the libGData library, as used by Evolution and other applications, did not properly verify SSL certificates. A remote attacker could exploit this to perform a man in the middle attack to view sensitive information or alter data transmitted via the GData protocol.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201208-06 (libgdata: Man-in-the-Middle attack)

    An error in the '_gdata_service_build_session()' function of       gdata-service.c prevents libgdata from properly validating certificates.
  Impact :

    A remote attacker could perform man-in-the-middle attacks to spoof       arbitrary SSL servers via a crafted certificate.
  Workaround :

    There is no known workaround at this time.

Vreixo Formoso discovered that libgdata, a library used to access various Google services, wasn't validating certificates against trusted system root CAs when using an HTTPS connection.

ID	Name	Product	Family	Severity
217672	Linux Distros Unpatched Vulnerability : CVE-2012-1177	Nessus	Misc.	high
74676	openSUSE Security Update : libgdata (openSUSE-SU-2012:0862-1)	Nessus	SuSE Local Security Checks	medium
61964	Mandriva Linux Security Advisory : libgdata (MDVSA-2012:111)	Nessus	Mandriva Local Security Checks	medium
61707	Ubuntu 10.04 LTS / 11.04 / 11.10 : libgdata, evolution-data-server vulnerability (USN-1547-1)	Nessus	Ubuntu Local Security Checks	medium
61545	GLSA-201208-06 : libgdata: Man-in-the-Middle attack	Nessus	Gentoo Local Security Checks	medium
59760	Debian DSA-2482-1 : libgdata - insufficient certificate validation	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2012-1177

high

Tenable Plugins

high

medium

medium

medium

medium

medium