libgadu before 1.12.0 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers.

The remote host is affected by the vulnerability described in GLSA-201508-02 (libgadu: Multiple vulnerabilities)

    libgadu contains multiple vulnerabilities:
      X.509 certificates are not properly validated (CVE-2013-4488)       A integer overflow error could lead to a buffer overflow         (CVE-2013-6487)       Malformed responses from a Gadu-Gadu file relay server are not         properly handled (CVE-2014-3775)   Impact :

    A remote attacker may be able to execute arbitrary code with the       privileges of the process, cause a Denial of Service condition, or spoof       servers.
  Workaround :

    There is no known workaround at this time.

Updated libgadu packages fix security vulnerability :

Libgadu before 1.12.0 was found to not be performing SSL certificate validation (CVE-2013-4488).

From upstream changelog :

  - Support for Gadu-Gadu 11 protocol.

    - Enable server certificate verification.

    - Allow using custom TCP/TLS connection functions.

    - Allow specifying server by name, not just IP.

    - Small bugfixes reported by Pidgin project based on       Coverity audit.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
85430	GLSA-201508-02 : libgadu: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
77842	Mandriva Linux Security Advisory : libgadu (MDVSA-2014:185)	Nessus	Mandriva Local Security Checks	medium
71755	Fedora 19 : libgadu-1.12.0-0.2.rc1.fc19 (2013-23517)	Nessus	Fedora Local Security Checks	medium
71754	Fedora 20 : libgadu-1.12.0-0.2.rc1.fc20 (2013-23260)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2013-4488

medium

Tenable Plugins

high

medium

medium

medium