REDHAT-BUG-1025718: Medium severity centos libgcc vulnerability

Libgadu, an open library for communicating using the protocol e-mail, was found to have missing the ssl certificate validation. The issue is that libgadu uses openSSL library for creating secure connections. A program using openSSL can perform SSL handshake by invoking the SSLconnect function. Some cetrificate validation errors are signaled through, the return values of the SSLconnect, while for the others errors SSLconnect returns OK but sets internal "verify result" flags. Application must call sslgetverifyresult function to check if any such errors occurred. This check seems to be missing in libgadu. And thus a man-in-the-middle attack is possible failing all the SSL protection.

Upstream suggested that it was a concious decision as libgadu is reverse-engineered implementation of a proprietary protocol, they had no control over the certificates used for SSL connections, so they would add a note to the documentation about this.

References: http://seclists.org/oss-sec/2013/q4/202 https://bugzilla.novell.com/showbug.cgi?id=848509 http://www.mail-archive.com/libgadu-devel@lists.ziew.org/msg01017.html