| The Vigil@nce team watches public vulnerabilities impacting your computers, and then offers security solutions, a vigilance database and tools to fix them. |
|
 |
|
|
Synthesis of the vulnerability 
An attacker can create a malicious certificate, which is accepted as valid by GnuTLS, in order to invite the victim to connect to a server setup as a Man-in-the-Middle.
 Impacted software: Unix (platform) ~ not comprehensive.
Severity of this computer vulnerability: 2/4.
Creation date: 04/04/2014.
Références of this announce: VIGILANCE-VUL-14524.
Description of the vulnerability 
The GnuTLS library implements the SSL/TLS protocol. It has to perform checks on X.509 certificates.
However, this library accepts a certificate with the same issuer and subject, and a valid chain of trust.
An attacker can therefore create a malicious certificate, which is accepted as valid by GnuTLS, in order to invite the victim to connect to a server setup as a Man-in-the-Middle.
Full bulletin, software filtering, emails, fixes, ... (Request your free trial)
This vulnerability bulletin impacts software or systems such as Unix (platform) ~ not comprehensive.
Our Vigil@nce team determined that the severity of this security note is medium.
The trust level is of type multiples sources, with an origin of internet server.
An attacker with a expert ability can exploit this cybersecurity note.
Solutions for this threat 
Full bulletin, software filtering, emails, fixes, ... (Request your free trial)
Computer vulnerabilities tracking service 
Vigil@nce provides a computer vulnerability patch. The Vigil@nce team tracks computer vulnerabilities impacting systems and applications.
|