CVE-2011-1094 kio/kio/tcpslavebase.cpp in KDE KSSL in kdelibs before 4.6.1 does not properly verify that the server hostname matches the domain name of the subject of an X.509 certificate, which allows man-in-the-m...
MediumCVSS 4.3
EPSS 1.00%
- Published
- Updated
- Exploit status
- No public exploit known
Description
kio/kio/tcpslavebase.cpp in KDE KSSL in kdelibs before 4.6.1 does not properly verify that the server hostname matches the domain name of the subject of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a certificate issued by a legitimate Certification Authority for an IP address, a different vulnerability than CVE-2009-2702.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/kde4libs(Debian:10) | < 4:4.4.5-4 | 4:4.4.5-4 |
| redhat kdelibs | <= 4.6 | No fix listed |
| redhat kdelibs | = 3.5.2 | No fix listed |
| redhat kdelibs | = 3.5.9 | No fix listed |
| redhat kdelibs | = 3.5.10 | No fix listed |
References
- 44108 third-party-advisory vendor-advisory
- MDVSA-2011:071 vendor-advisory
- USN-1110-1 vendor-advisory
- ADV-2011-0913 vdb-entry vendor-advisory
- ADV-2011-0990 vdb-entry vendor-advisory
- [oss-security] 20110308 KDE SSL name check issue mailing-list patch
- [oss-security] 20110308 Re: KDE SSL name check issue mailing-list patch
- projects.kde.org patch
- 46789 vdb-entry
- kdelibs-ssl-security-bypass(65986) vdb-entry