Ubuntu 11.10: 1547-1 Moderate: libGData Man In The Middle Attack

ubuntu

August 28, 2012

Applications using GData services could be made to expose sensitiveinformation over the network.

Summary

Applications using GData services could be made to expose sensitive

information over the network.

Software Description:

- libgdata: Library to access GData services

- evolution-data-server: Evolution suite data server

Details:

Vreixo Formoso discovered that the libGData library, as used

by Evolution and other applications, did not properly verify SSL

certificates. A remote attacker could exploit this to perform a man

in the middle attack to view sensitive information or alter data

transmitted via the GData protocol.

Topics Covered

security advisory Ubuntu evolution-data-server data exposure man in the middle libgdata

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 11.10:
  libgdata13                      0.9.1-0ubuntu2.1

Ubuntu 11.04:
  libgdata11                      0.8.0-0ubuntu1.1

Ubuntu 10.04 LTS:
  libgdata-google1.2-1            2.28.3.1-0ubuntu6.1
  libgdata1.2-1                   2.28.3.1-0ubuntu6.1
  libgdata6                       0.5.2-0ubuntu1.1

In general, a standard system update will make all the necessary changes.