CVE-2013-4488: Medium severity centos libgcc vulnerability
libgadu before 1.12.0 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers.
Other sources
Libgadu, an open library for communicating using the protocol e-mail, was found to have missing the ssl certificate validation. The issue is that libgadu uses openSSL library for creating secure connections. A program using openSSL can perform SSL handshake by invoking the SSLconnect function. Some cetrificate validation errors are signaled through, the return values of the SSLconnect, while for the others errors SSLconnect returns OK but sets internal "verify result" flags. Application must call sslgetverifyresult function to check if any such errors occurred. This check seems to be missing in libgadu. And thus a man-in-the-middle attack is possible failing all the SSL protection.
Upstream suggested that it was a concious decision as libgadu is reverse-engineered implementation of a proprietary protocol, they had no control over the certificates used for SSL connections, so they would add a note to the documentation about this.
References: http://seclists.org/oss-sec/2013/q4/202 https://bugzilla.novell.com/showbug.cgi?id=848509 http://www.mail-archive.com/libgadu-devel@lists.ziew.org/msg01017.html
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2013-4488?
CVE-2013-4488 has a medium severity rating due to its potential to allow man-in-the-middle attacks.
How do I fix CVE-2013-4488?
To fix CVE-2013-4488, upgrade libgadu to version 1.12.0 or later, which includes proper SSL certificate validation.
What does CVE-2013-4488 exploit?
CVE-2013-4488 exploits the lack of verification of X.509 certificates from SSL servers in vulnerable versions of libgadu.
Which versions of libgadu are affected by CVE-2013-4488?
All versions of libgadu prior to 1.12.0 are affected by CVE-2013-4488.
What protocol does libgadu use that is affected by CVE-2013-4488?
Libgadu utilizes the e-mail communication protocol, which is compromised in the context of CVE-2013-4488 due to SSL certificate validation issues.