Ubuntu 12.04 LTS: 1465-1 Moderate: Fraudulent Certificate Threat

ubuntu

June 6, 2012

Fraudulent security certificates could allow sensitive information to be exposed when accessing the Internet.

Summary

Fraudulent security certificates could allow sensitive information to

be exposed when accessing the Internet.

Software Description:

- ubuntuone-client: Ubuntu One client

Details:

It was discovered that the Ubuntu One Client incorrectly validated server

certificates when using HTTPS connections. If a remote attacker were able

to perform a man-in-the-middle attack, this flaw could be exploited to

alter or compromise confidential information.

Topics Covered

security advisory security issue ubuntu man-in-the-middle sensitive data certificate validation client advisory

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 12.04 LTS:
  python-ubuntuone-client         3.0.0-0ubuntu1.1

Ubuntu 11.10:
  python-ubuntuone-client         2.0.1-0ubuntu1.1

Ubuntu 11.04:
  python-ubuntuone-client         1.6.2-0ubuntu2.1

Ubuntu 10.04 LTS:
  python-ubuntuone-client         1.2.2-0ubuntu2.2

In general, a standard system update will make all the necessary changes.