« Volver al listado

CVE-2007-6746

Estado: ModificadaMedia (5.8)—

telepathy-idle anterior a 0.1.15 no verifica que (1) el distribuidor es una CA confiable, (2) que el hostname del servidor coincide con el nombre en el asunto del Common Name (CN) o (3) la fecha de expiración del certificado X.509, lo que permite a atacantes man-in-the-middle suplantar servidores SSL a través de un certificado no válido.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Canonical — Telepathy-idleCanonical — Ubuntu Linux

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2007-6746",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5.8,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 4.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "secalert@redhat.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2013-05-21T18:55:01.310",
  "references": [
    {
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2013-May/104397.html",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-updates/2013-06/msg00052.html",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://secunia.com/advisories/53361",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2013/04/24/5",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.securityfocus.com/bid/59474",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://www.ubuntu.com/usn/USN-1821-1",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://bugs.freedesktop.org/show_bug.cgi?id=63810",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2013-May/104397.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-updates/2013-06/msg00052.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/53361",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2013/04/24/5",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/59474",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.ubuntu.com/usn/USN-1821-1",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://bugs.freedesktop.org/show_bug.cgi?id=63810",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "telepathy-idle before 0.1.15 does not verify (1) that the issuer is a trusted CA, (2) that the server hostname matches a domain name in the subject's Common Name (CN), or (3) the expiration date of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate."
    },
    {
      "lang": "es",
      "value": "telepathy-idle anterior a 0.1.15 no verifica que (1) el distribuidor es una CA confiable, (2) que el hostname del servidor coincide con el nombre en el asunto del Common Name (CN) o (3) la fecha de expiración del certificado X.509, lo que permite a atacantes man-in-the-middle suplantar servidores SSL a través de un certificado no válido."
    }
  ],
  "lastModified": "2026-06-16T22:48:41.563",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:canonical:telepathy-idle:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "75CB41AF-0E22-493E-8FFC-665A52A4FA94",
              "versionEndIncluding": "0.1.14.1"
            },
            {
              "criteria": "cpe:2.3:a:canonical:telepathy-idle:0.1.10.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0CF89A66-0430-4996-B111-0FAA8BEA4F48"
            },
            {
              "criteria": "cpe:2.3:a:canonical:telepathy-idle:0.1.11.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6DD49620-682F-4D96-94D4-7222ACFD2DD3"
            },
            {
              "criteria": "cpe:2.3:a:canonical:telepathy-idle:0.1.11.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5EA5DE9F-706D-4614-BE8F-7D18095C80B8"
            },
            {
              "criteria": "cpe:2.3:a:canonical:telepathy-idle:0.1.12.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F7226581-E07D-48F7-BCDE-6543701121BA"
            },
            {
              "criteria": "cpe:2.3:a:canonical:telepathy-idle:0.1.14:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5FAAC939-D9E6-4C0B-A769-D902EC4FAA16"
            },
            {
              "criteria": "cpe:2.3:o:canonical:ubuntu_linux:12.04:-:lts:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F5D324C4-97C7-49D3-A809-9EAD4B690C69"
            },
            {
              "criteria": "cpe:2.3:o:canonical:ubuntu_linux:12.10:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E2076871-2E80-4605-A470-A41C1A8EC7EE"
            },
            {
              "criteria": "cpe:2.3:o:canonical:ubuntu_linux:13.04:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EFAA48D9-BEB4-4E49-AD50-325C262D46D9"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "secalert@redhat.com"
}