Ubuntu: 1465-2 Moderate: Man-in-the-Middle Threat on One Storage Protocol

ubuntu

June 6, 2012

Fraudulent security certificates could allow sensitive information to be exposed when accessing the Internet.

Summary

Fraudulent security certificates could allow sensitive information to

be exposed when accessing the Internet.

Software Description:

- ubuntuone-storage-protocol: Python library for Ubuntu One file storage and sharing service

Details:

USN-1465-1 fixed a vulnerability in the Ubuntu One Client. This update adds

a required fix to the Ubuntu One storage protocol library.

Original advisory details:

It was discovered that the Ubuntu One Client incorrectly validated server

certificates when using HTTPS connections. If a remote attacker were able

to perform a man-in-the-middle attack, this flaw could be exploited to

alter or compromise confidential information.

Topics Covered

security advisory Ubuntu man-in-the-middle sensitive data certificate issue storage protocol

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 12.04 LTS:
  python-ubuntuone-storageprotocol  3.0.0-0ubuntu1.1

Ubuntu 11.10:
  python-ubuntuone-storageprotocol  2.0.1-0ubuntu1.1

Ubuntu 11.04:
  python-ubuntuone-storageprotocol  1.6.1-0ubuntu1.2

Ubuntu 10.04 LTS:
  python-ubuntuone-storageprotocol  1.2.0-0ubuntu1.1

In general, a standard system update will make all the necessary changes.