Published: 16/04/2010 Updated: 17/08/2017

CVSS v2 Base Score: 6.8 | Impact Score: 6.4 | Exploitability Score: 8.6

VMScore: 605

Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P

Irssi prior to 0.8.15, when SSL is used, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) field or a Subject Alternative Name field of the X.509 certificate, which allows man-in-the-middle malicious users to spoof IRC servers via an arbitrary certificate.

Vulnerable Product	Search on Vulmon	Subscribe to Product
irssi irssi 0.8.5
irssi irssi
irssi irssi 0.8.14
irssi irssi 0.8.10
irssi irssi 0.8.8
irssi irssi 0.8.7
irssi irssi 0.8.12
irssi irssi 0.8.11
irssi irssi 0.8.3
irssi irssi 0.8.2
irssi irssi 0.8.13
irssi irssi 0.8.6
irssi irssi 0.8.1
irssi irssi 0.8.0
irssi irssi 0.8.4
irssi irssi 0.8.9

USN-929-1 fixed vulnerabilities in irssi The upstream changes introduced a regression when using irssi with SSL and an IRC proxy This update fixes the problem ...

It was discovered that irssi did not perform certificate host validation when using SSL connections An attacker could exploit this to perform a man in the middle attack to view sensitive information or alter encrypted communications (CVE-2010-1155) ...

CWE-20 http://www.ubuntu.com/usn/USN-929-1 http://marc.info/?l=oss-security&m=127116251220784&w=2 http://secunia.com/advisories/39365 http://irssi.org/news/ChangeLog http://marc.info/?l=oss-security&m=127110132019166&w=2 http://www.vupen.com/english/advisories/2010/0856 http://irssi.org/news http://github.com/ensc/irssi-proxy/commit/85bbc05b21678e80423815d2ef1dfe26208491ab http://marc.info/?l=oss-security&m=127119240204394&w=2 http://marc.info/?l=oss-security&m=127098845125270&w=2 http://slackware.com/security/viewer.php?l=slackware-security&y=2010&m=slackware-security.497301 http://secunia.com/advisories/39620 http://www.vupen.com/english/advisories/2010/0987 http://www.vupen.com/english/advisories/2010/1110 http://secunia.com/advisories/39797 http://lists.fedoraproject.org/pipermail/package-announce/2010-May/041054.html http://www.vupen.com/english/advisories/2010/1107 http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00001.html https://exchange.xforce.ibmcloud.com/vulnerabilities/57790 https://nvd.nist.gov https://usn.ubuntu.com/929-2/

CVE-2010-1155

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect