CVE-2010-3901 OpenConnect before 2.25 does not properly validate X.509 certificates, which allows man-in-the-middle attackers to spoof arbitrary AnyConnect SSL VPN servers via a crafted server certificate that (1)....
MediumCVSS 6.4
EPSS 0.60%
- Published
- Updated
- Exploit status
- No public exploit known
Description
OpenConnect before 2.25 does not properly validate X.509 certificates, which allows man-in-the-middle attackers to spoof arbitrary AnyConnect SSL VPN servers via a crafted server certificate that (1) does not correspond to the server hostname or (2) is presented in circumstances involving a missing --cafile configuration option.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| infradead openconnect | <= 2.22 | No fix listed |
| infradead openconnect | = 1.00 | No fix listed |
| infradead openconnect | = 1.10 | No fix listed |
| infradead openconnect | = 1.20 | No fix listed |
| infradead openconnect | = 1.30 | No fix listed |
| debian/openconnect(Debian:12) | < 2.25-0.1 | 2.25-0.1 |
| debian/openconnect(Debian:13) | < 2.25-0.1 | 2.25-0.1 |
| debian/openconnect(Debian:14) | < 2.25-0.1 | 2.25-0.1 |
References
- www.infradead.org
- [oss-security] 20100801 CVE Request -- OpenConnect < v2.25 did not verify SSL server certificates mailing-list
- [oss-security] 20100802 Re: CVE Request -- OpenConnect < v2.25 did not verify SSL server certificates mailing-list
- Debian Security Tracker CVE-2010-3901 vendor-advisory
- bugs.debian.org issue-tracking