Description
Isync 0.4 before 1.0.6, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | isync | 1.0.4-2.2 | — |
| Debian 13 | isync | 1.0.4-2.2 | — |
| Debian 12 | isync | 1.0.4-2.2 | — |
References
- FEDORA-2013-2758 vendor-advisory
- 57423 vdb-entry
- isync-ssl-info-disc(82232) vdb-entry
- [oss-security] 20130220 isync/mbsync security advisory: missing SSL subject verification (CVE-2013-0289) mailing-list
- 55190 third-party-advisory
- http://sourceforge.net/projects/isync/files/isync/1.0.6/
- http://sourceforge.net/p/isync/isync/ci/914ede18664980925628a9ed2a73ad05f85aeedb
- GLSA-201310-02 vendor-advisory
- FEDORA-2013-2795 vendor-advisory