Published: 02/04/2013 Updated: 02/04/2013

CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6

VMScore: 383

Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N

Gnome Online Accounts (GOA) 3.4.x, 3.6.x prior to 3.6.3, and 3.7.x prior to 3.7.5, does not properly validate SSL certificates when creating accounts such as Windows Live and Facebook accounts, which allows man-in-the-middle malicious users to obtain sensitive information such as credentials by sniffing the network.

Vulnerable Product	Search on Vulmon	Subscribe to Product
gnome gnome online accounts 3.4.0
gnome gnome online accounts 3.4.1
gnome gnome online accounts 3.6.0
gnome gnome online accounts 3.6.1
gnome gnome online accounts 3.6.2
gnome gnome online accounts 3.7.1
gnome gnome online accounts 3.7.3
gnome gnome online accounts 3.7.2
gnome gnome online accounts 3.7.4
canonical ubuntu linux 11.10
canonical ubuntu linux 12.10
canonical ubuntu linux 12.04

Debian Bug report logs - #699825 CVE-2013-0240: fails to verify SSL certificates when creating accounts Package: gnome-online-accounts; Maintainer for gnome-online-accounts is Debian GNOME Maintainers <pkg-gnome-maintainers@listsaliothdebianorg>; Source for gnome-online-accounts is src:gnome-online-accounts (PTS, buildd, popcon) ...

GNOME Online Accounts could be made to expose sensitive information over the network ...

CWE-310 https://bugzilla.gnome.org/show_bug.cgi?id=693214 http://secunia.com/advisories/52791 http://secunia.com/advisories/51976 https://bugzilla.redhat.com/show_bug.cgi?id=894352 http://ubuntu.com/usn/usn-1779-1 https://git.gnome.org/browse/gnome-online-accounts/commit/?h=gnome-3-6&id=ecad8142e9ac519b9fc74b96dcb5531052bbffe1 https://git.gnome.org/browse/gnome-online-accounts/commit/?id=edde7c63326242a60a075341d3fea0be0bc4d80e https://mail.gnome.org/archives/gnome-announce-list/2013-March/msg00007.html http://lists.opensuse.org/opensuse-updates/2013-02/msg00046.html https://git.gnome.org/browse/gnome-online-accounts/commit/?id=bc10fdb68f75f8be84eb698ada08743b9c7c248f https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=699825 https://usn.ubuntu.com/1779-1/https://nvd.nist.gov

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

CVE-2013-0240

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect