security advisorymoderatedebian
Maksim Otstavnov discovered that the Wocky submodule used by telepathy-gabble, the Jabber/XMPP connection manager for the Telepathy framework, does not respect the tls-required flag on legacy Jabber servers. A network intermediary could use this vulnerability to bypass . - ------------------------------------------------------------------------- Debian Security Advisory DSA-2702-1 This email address is being protected from spambots. You need JavaScript enabled to view it. http://www.debian.org/security/ Salvatore Bonaccorso June 03, 2013 http://www.debian.org/security/faq - ------------------------------------------------------------------------- Package : telepathy-gabble Vulnerability : TLS verification bypass Problem type : remote Debian-specific: no CVE ID : CVE-2013-1431 Maksim Otstavnov discovered that the Wocky submodule used by telepathy-gabble, the Jabber/XMPP connection manager for the Telepathy framework, does not respect the tls-required flag on legacy Jabber servers. A network intermediary could use this vulnerability to bypass TLS verification and perform a man-in-the-middle attack. For the oldstable distribution (squeeze), this problem has been fixed in version 0.9.15-1+squeeze2. For the stable distribution (wheezy), this problem has been fixed in version 0.16.5-1+deb7u1. For the testing distribution (jessie) and the unstable distribution (sid), this problem has been fixed in version 0.16.6-1. We recommend that you upgrade your telepathy-gabble packages. Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: http://www.debian.org/security/ Mailing list: This email address is being protected from spambots. You need JavaScript enabled to view it. . Ubuntu Security Notice USN-5002-1 addresses a critical vulnerability in libglib2.0, prompting an immediate patch.. Debian Security Advisory, Telepathy Gabble Fix, TLS Bypass Alert, Network Security Update. . LinuxSecurity.com Team
Jun 03, 2013
Debian