Cryptographic issues in Novell Opensuse

1) Cryptographic issues

EUVDB-ID: #VU41216

Risk: Medium

CVSSv3.1: 6.4 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2014-2576

CWE-ID: CWE-310 - Cryptographic Issues

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

plugins/rssyl/feed.c in Claws Mail before 3.10.0 disables the CURLOPT_SSL_VERIFYHOST check for CN or SAN host name fields, which makes it easier for remote attackers to spoof servers and conduct man-in-the-middle (MITM) attacks.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Opensuse: 12.3 - 13.1

CPE2.3

• cpe:2.3:o:suse:opensuse:12.3:*:*:*:*:*:*:*
• cpe:2.3:o:suse:opensuse:13.1:*:*:*:*:*:*:*

External links

http://lists.opensuse.org/opensuse-updates/2014-10/msg00015.html
http://seclists.org/oss-sec/2014/q1/636
http://secunia.com/advisories/60422
http://sourceforge.net/p/claws-mail/news/2014/05/claws-mail-3100-unleashed/
http://www.thewildbeast.co.uk/claws-mail/bugzilla/show_bug.cgi?id=3106

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.