EUVD-2008-3518

Malware in sbrugna...

pidgin: NSS plugin doesn't verify SSL certificates

The NSS plugin in libpurple in Pidgin 2.4.3 does not verify SSL certificates, which makes it easier for remote attackers to trick a user into accepting an invalid server certificate for a spoofed service...

Code injection

The NSS plugin in libpurple in Pidgin 2.4.3 does not verify SSL certificates, which makes it easier for remote attackers to trick a user into accepting an invalid server certificate for a spoofed service...

CVE-2008-3532

The NSS plugin in libpurple in Pidgin 2.4.3 does not verify SSL certificates, which makes it easier for remote attackers to trick a user into accepting an invalid server certificate for a spoofed service...

CVE-2008-3532

The NSS plugin in libpurple in Pidgin 2.4.3 does not verify SSL certificates, which makes it easier for remote attackers to trick a user into accepting an invalid server certificate for a spoofed service...

CVE-2008-3532

The NSS plugin in libpurple in Pidgin 2.4.3 does not verify SSL certificates, which makes it easier for remote attackers to trick a user into accepting an invalid server certificate for a spoofed service...

Pidgin NSS插件SSL证书验证安全绕过漏洞

BUGTRAQ ID: 30553 CNCAN ID：CNCAN-2008080604 Pidgin是一款功能强大支持多个协议的开源即时通讯软件。 Pidgin NNS插件不正确验证服务器的SSL证书，远程攻击者可以利用漏洞绕过安全限制，执行中间人攻击。 设置一个Jabber服务器，使用默认的snakeoil证书，当配置pidgin连接新的服务器时，使用SSL，在连接过程中没有任何提示。这可导致用户盲目信任连接是安全的而遭受中间人攻击。 Pidgin 2.4.3 可参考如下补丁： Pidgin Pidgin 2.4.3 Pidgin nss-cert-verify.patch...