NVD Vulnerability Detail

CVE-2014-3694

Summary	The (1) bundled GnuTLS SSL/TLS plugin and the (2) bundled OpenSSL SSL/TLS plugin in libpurple in Pidgin before 2.10.10 do not properly consider the Basic Constraints extension during verification of X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.
Publication Date	Oct. 29, 2014, 7:55 p.m.
Registration Date	Jan. 26, 2021, 3:11 p.m.
Last Update	Nov. 21, 2024, 11:08 a.m.

Affected software configurations

Configuration2	or higher	or less	more than	less than
cpe:2.3:o:canonical:ubuntu_linux:12.04::::lts:::
cpe:2.3:o:canonical:ubuntu_linux:14.10:::::::*
cpe:2.3:o:canonical:ubuntu_linux:14.04::::lts:::

Configuration3		or higher	or less	more than	less than
cpe:2.3:o:debian:debian_linux:7.0:::::::*

Related information, measures and tools

No	URL	タグ
1	http://hg.pidgin.im/pidgin/main/rev/2e4475087f04	Issue Tracking
2	http://hg.pidgin.im/pidgin/main/rev/2e4475087f04	Issue Tracking
3	http://lists.opensuse.org/opensuse-updates/2014-11/msg00023.html	Third Party Advisory
4	http://lists.opensuse.org/opensuse-updates/2014-11/msg00023.html	Third Party Advisory
5	http://lists.opensuse.org/opensuse-updates/2014-11/msg00037.html	Third Party Advisory
6	http://lists.opensuse.org/opensuse-updates/2014-11/msg00037.html	Third Party Advisory
7	http://pidgin.im/news/security/?id=86	Patch Vendor Advisory
8	http://pidgin.im/news/security/?id=86	Patch Vendor Advisory
9	http://secunia.com/advisories/60741
10	http://secunia.com/advisories/60741
11	http://secunia.com/advisories/61968
12	http://secunia.com/advisories/61968
13	http://www.debian.org/security/2014/dsa-3055	Third Party Advisory
14	http://www.debian.org/security/2014/dsa-3055	Third Party Advisory
15	http://www.ubuntu.com/usn/USN-2390-1	Third Party Advisory
16	http://www.ubuntu.com/usn/USN-2390-1	Third Party Advisory
17	https://access.redhat.com/errata/RHSA-2017:1854
18	https://access.redhat.com/errata/RHSA-2017:1854

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-310	暗号の問題	https://cwe.mitre.org/data/definitions/310.html

JVN Vulnerability Information

Pidgin の libpurple にバンドルされている GnuTLS SSL/TLS および OpenSSL SSL/TLS プラグインにおけるサーバになりすまされる脆弱性

Title	Pidgin の libpurple にバンドルされている GnuTLS SSL/TLS および OpenSSL SSL/TLS プラグインにおけるサーバになりすまされる脆弱性
Summary	Pidgin の libpurple にバンドルされている (1) GnuTLS SSL/TLS および (2) OpenSSL SSL/TLS プラグインは、SSL サーバからの X.509 証明書の検証中に Basic Constraints 拡張機能を適切に考慮しないため、サーバになりすまされ、重要な情報を取得される脆弱性が存在します。
Possible impacts	中間者攻撃 (man-in-the-middle attack) により、巧妙に細工された証明書を介して、サーバになりすまされ、重要な情報を取得される可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Oct. 12, 2014, midnight
Registration Date	Oct. 30, 2014, 4:37 p.m.
Last Update	June 19, 2015, 4:43 p.m.

Affected System

Pidgin

Pidgin 2.10.10 未満

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2014-3694	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3694
National Vulnerability Database (NVD)
2	CVE-2014-3694	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-3694

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-310	https://jvndb.jvn.jp/ja/cwe/CWE-310.html

ベンダー情報

No	Name	URL
Oracle Technology Network
1	Oracle Solaris Third Party Bulletin - April 2015	http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html
Pidgin
2	Fix basic constraints checking for both our SSL plugins.	http://hg.pidgin.im/pidgin/main/rev/2e4475087f04
Pidgin Security Advisories
3	Insufficient SSL certificate validation	https://pidgin.im/news/security/?id=86

Change Log

No	Changed Details	Date of change
0	[2014年10月30日] 掲載 [2015年06月19日] ベンダ情報：オラクル (Oracle Solaris Third Party Bulletin - April 2015) を追加	Feb. 17, 2018, 10:37 a.m.