CVE-2011-4092: Input Validation
obby (aka libobby) does not verify SSL server certificates, which allows remote attackers to spoof servers via an arbitrary certificate.
Other sources
Vasiliy Kulikov reported [1] that obby does not check a server's SSL certificate when connecting. It also sends the password in plaintext form over the SSL channel. An attacker able to perform a MITM attack on the connection could easily do so without discovery due to obby not checking the server's SSL certificate.
Note: if the client is Gobby, the reconnection attempt will require user interaction.
Upstream has indicated [2] that it is not worth the effort to implement SSL certificate checking in obby as it is deprecated by libinfinity, which is used by the development version of Gobby, so there is currently no fix for obby.
[1] http://www.openwall.com/lists/oss-security/2011/10/30/3 [2] http://www.openwall.com/lists/oss-security/2011/10/30/5
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2011-4092?
CVE-2011-4092 is considered a critical vulnerability due to its potential for server spoofing and plaintext credential transmission.
How do I fix CVE-2011-4092?
To fix CVE-2011-4092, ensure that your version of Obby is updated to a version that implements SSL certificate verification.
What are the consequences of CVE-2011-4092?
The main consequence of CVE-2011-4092 is that an attacker could impersonate a legitimate server and intercept sensitive information transmitted by users.
Which versions of Obby are affected by CVE-2011-4092?
CVE-2011-4092 affects all versions of Obby prior to the implementation of SSL certificate verification.
Is there any workaround for CVE-2011-4092 if I cannot update immediately?
As a workaround for CVE-2011-4092, consider using a VPN or other secure communication method to protect data while you arrange for updates.