CVE-2011-4409

2012-06-0600:00:00

ubuntu.com

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS

0.009

Percentile

82.8%

JSON

The Ubuntu One Client for Ubuntu 10.04 LTS, 11.04, 11.10, and 12.04 LTS
does not properly validate SSL certificates, which allows remote attackers
to spoof a server and modify or read sensitive information via a
man-in-the-middle (MITM) attack.

Bugs

<https://bugs.launchpad.net/ubuntu/+source/ubuntuone-client/+bug/882062>

OSVersionArchitecturePackageVersionFilename
ubuntu10.04noarchubuntuone-client< 1.2.2-0ubuntu2.2UNKNOWN
ubuntu11.04noarchubuntuone-client< 1.6.2-0ubuntu2.1UNKNOWN
ubuntu11.10noarchubuntuone-client< 2.0.1-0ubuntu1.1UNKNOWN
ubuntu12.04noarchubuntuone-client< 3.0.0-0ubuntu1.1UNKNOWN
ubuntu10.04noarchubuntuone-storage-protocol< 1.2.0-0ubuntu1.1UNKNOWN
ubuntu11.04noarchubuntuone-storage-protocol< 1.6.1-0ubuntu1.2UNKNOWN
ubuntu11.10noarchubuntuone-storage-protocol< 2.0.1-0ubuntu1.1UNKNOWN
ubuntu12.04noarchubuntuone-storage-protocol< 3.0.0-0ubuntu1.1UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	10.04	noarch	ubuntuone-client	< 1.2.2-0ubuntu2.2	UNKNOWN
ubuntu	11.04	noarch	ubuntuone-client	< 1.6.2-0ubuntu2.1	UNKNOWN
ubuntu	11.10	noarch	ubuntuone-client	< 2.0.1-0ubuntu1.1	UNKNOWN
ubuntu	12.04	noarch	ubuntuone-client	< 3.0.0-0ubuntu1.1	UNKNOWN
ubuntu	10.04	noarch	ubuntuone-storage-protocol	< 1.2.0-0ubuntu1.1	UNKNOWN
ubuntu	11.04	noarch	ubuntuone-storage-protocol	< 1.6.1-0ubuntu1.2	UNKNOWN
ubuntu	11.10	noarch	ubuntuone-storage-protocol	< 2.0.1-0ubuntu1.1	UNKNOWN
ubuntu	12.04	noarch	ubuntuone-storage-protocol	< 3.0.0-0ubuntu1.1	UNKNOWN