CVE-2011-4092 obby (aka libobby) does not verify SSL server certificates, which allows remote attackers to spoof servers via an arbitrary certificate.

MediumCVSS 5.8 EPSS 0.81%

Published: 2014-02-10 19:00
Updated: 2026-06-17 02:34
Exploit status: No public exploit known

Sign in for asset impact Search another CVE

Description

obby (aka libobby) does not verify SSL server certificates, which allows remote attackers to spoof servers via an arbitrary certificate.

Affected products

Product	Affected versions	Fixed in
ubuntu developers obby	All versions	No fix listed

References

[oss-security] 20111030 Re: CVE request: 3 flaws in libobby and libnet6 mailing-list
[oss-security] 20111031 Re: CVE request: 3 flaws in libobby and libnet6 exploit mailing-list
bugzilla.redhat.com

CVSS v2.0

5.8 Medium

AV:N/AC:M/Au:N/C:P/I:P/A:N

Access Vector: Network
Access Complexity: Medium
Authentication: None
Confidentiality: Partial
Integrity: Partial
Availability: None

Weakness & likelihood

EPSS (exploitation probability, 30 days): 0.81% (percentile 57.4)
CWE: CWE-20

Public exploit references

Metadata only. CVERadar never hosts or runs exploit code.

No public exploit references known.