CVE-2014-3694: Medium severity opensuse vulnerability
It was reported that the SSL/TLS plug-ins failed to check that the Basic Constraints extension allowed intermediate certificates to act as Certificate Authorities (CAs). An attacker could use this flaw to create a fake certificate that Pidgin would trust, which could be used for man-in-the-middle attacks.
This is the same situation as described in http://www.thoughtcrime.org/ie-ssl-chain.txt
Acknowledgments:
Name: the Pidgin project Upstream: Jacob Appelbaum, Moxie Marlinspike
Other sources
The (1) bundled GnuTLS SSL/TLS plugin and the (2) bundled OpenSSL SSL/TLS plugin in libpurple in Pidgin before 2.10.10 do not properly consider the Basic Constraints extension during verification of X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2014-3694?
CVE-2014-3694 is considered a high severity vulnerability due to its potential for exploitation in man-in-the-middle attacks.
How do I fix CVE-2014-3694?
To fix CVE-2014-3694, update Pidgin to version 2.10.10 or later.
Which software versions are affected by CVE-2014-3694?
CVE-2014-3694 affects Pidgin versions up to and including 2.10.9 and multiple versions of OpenSUSE, Ubuntu, and Debian.
What type of attack can exploit CVE-2014-3694?
CVE-2014-3694 can be exploited to perform man-in-the-middle attacks by creating a fake certificate that Pidgin would trust.
Is there a workaround for CVE-2014-3694?
While the best solution is to apply the update, temporarily disabling SSL/TLS verification may serve as a workaround until patched.