CVE-2007-6746 Security feature bypass in n/a
Man-in-the-middle attackers can spoof SSL servers due to missing certificate validation in the telepathy-idle library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2007-6746?
CVE-2007-6746 is a medium-severity vulnerability in Canonical Ubuntu Linux, published on 21 May 2013. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
telepathy-idle before 0.1.15 does not verify (1) that the issuer is a trusted CA, (2) that the server hostname matches a domain name in the subject's Common Name (CN), or (3) the expiration date of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
Weakness: CWE-20
Which versions are affected by CVE-2007-6746?
It affects 2 products.
Linux distribution packages (1)
telepathy-idle openSUSE:Tumbleweed | All versions | 0.2.0-3.8 |
Products include Canonical Telepathy-Idle, Canonical Ubuntu Linux.
How do I fix CVE-2007-6746?
Upgrade to a fixed version.
Is CVE-2007-6746 being exploited?
There is no known exploitation of CVE-2007-6746 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2007-6746, GHSA-j9qv-wv66-7c38, openSUSE-SU-2024:10159-1.