CVE-2007-5162 - Secunia Advisories - Vulnerability Intelligence

CVE Reference: CVE-2007-5162
NOTE: The text on this page is written by CVE MITRE and reflects neither the opinions of Secunia or the results of our research. All data on this page is written and maintained by CVE MITRE.

Original Page at CVE MITRE: CVE-2007-5162

Description: The connect method in lib/net/http.rb in the (1) Net::HTTP and (2) Net::HTTPS libraries in Ruby 1.8.5 and 1.8.6 does not verify that the commonName (CN) field in a server certificate matches the domain name in an HTTPS request, which makes it easier for remote attackers to intercept SSL transmissions via a man-in-the-middle attack or spoofed web site.

CVE Status: Candidate

References: XF http://xforce.iss.net/xforce/xfdb/36861 UBUNTU http://www.ubuntu.com/usn/usn-596-1 SUSE http://www.novell.com/linux/security/advisories/2007_24_sr.html SREASON http://securityreason.com/securityalert/3180 SAID Secunia Advisory: SA28645 Secunia Advisory: SA27756 Secunia Advisory: SA27818 Secunia Advisory: SA27769 Secunia Advisory: SA27764 Secunia Advisory: SA27673 Secunia Advisory: SA27576 Secunia Advisory: SA27432 Secunia Advisory: SA26985 Secunia Advisory: SA27044 Secunia Advisory: SA29556 REDHAT http://www.redhat.com/support/errata/RHSA-2007-0961.html http://www.redhat.com/support/errata/RHSA-2007-0965.html MISC http://www.isecpartners.com/advisories/2007-006-rubyssl.txt MANDRIVA http://www.mandriva.com/security/advisories?name=MDVSA-2008:029 FEDORA DEBIAN http://www.debian.org/security/2007/dsa-1412 http://www.debian.org/security/2007/dsa-1411 http://www.debian.org/security/2007/dsa-1410 CONFIRM http://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=rev&revision=13504 http://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=rev&revision=13502 http://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=rev&revision=13500 http://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=rev&revision=13499 BUGTRAQ http://www.securityfocus.com/archive/1/archive/1/483577/100/0/threaded http://www.securityfocus.com/archive/1/archive/1/480987/100/0/threaded BID 25847

Return to the previous page.