CVE-2013-7449: Medium severity Canonical Ubuntu Linux vulnerability
The ssldoconnect function in common/server.c in HexChat before 2.10.2, XChat, and XChat-GNOME does not verify that the server hostname matches a domain name in the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
Other sources
XChat did not verify that the server hostname matched the domain name in the subject's Common Name (CN) or subjectAltName field in X.509 certificates. This could allow a man-in-the-middle attacker to spoof an SSL server if they had a certificate that was valid for any domain name.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2013-7449?
CVE-2013-7449 is considered a high severity vulnerability due to its potential to enable man-in-the-middle attacks.
How do I fix CVE-2013-7449?
To fix CVE-2013-7449, update HexChat to version 2.10.2 or later, or ensure compliance with XChat or XChat-GNOME's latest secure versions.
Which software is affected by CVE-2013-7449?
CVE-2013-7449 affects HexChat versions prior to 2.10.2, as well as XChat and XChat-GNOME without proper hostname verification.
Can CVE-2013-7449 allow attackers to impersonate a server?
Yes, CVE-2013-7449 allows man-in-the-middle attackers to spoof SSL servers through arbitrary valid certificates.
Where do I report issues related to CVE-2013-7449?
Issues related to CVE-2013-7449 can be reported in the respective projects' issue trackers or on relevant bug report platforms.