It was reported that the libgadu 1.12.0-rc3 release fixes a memory corruption issue, triggered by a crafted response from a file relay server:

http://www.openwall.com/lists/oss-security/2014/05/15/8

A malicious file relay server could possibly use this flaw to execute arbitrary code in an application that uses libgadu.

libgadu before 1.12.0 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers.

It was reported that the libgadu 1.12.0-rc3 release fixes a memory corruption issue, triggered by a crafted response from a file relay server:

http://www.openwall.com/lists/oss-security/2014/05/15/8

A malicious file relay server could possibly use this flaw to execute arbitrary code in an application that uses libgadu.

Libgadu, an open library for communicating using the protocol e-mail, was found to have missing the ssl certificate validation. The issue is that libgadu uses openSSL library for creating secure connections. A program using openSSL can perform SSL handshake by invoking the SSLconnect function. Some cetrificate validation errors are signaled through, the return values of the SSLconnect, while for the others errors SSLconnect returns OK but sets internal "verify result" flags. Application must call sslgetverifyresult function to check if any such errors occurred. This check seems to be missing in libgadu. And thus a man-in-the-middle attack is possible failing all the SSL protection.

Upstream suggested that it was a concious decision as libgadu is reverse-engineered implementation of a proprietary protocol, they had no control over the certificates used for SSL connections, so they would add a note to the documentation about this.

References: http://seclists.org/oss-sec/2013/q4/202 https://bugzilla.novell.com/showbug.cgi?id=848509 http://www.mail-archive.com/libgadu-devel@lists.ziew.org/msg01017.html