A Security vulnerability in GnuTLS (libgnutls(3)) library X.509 certificate chain validation may cause client applications to trust certificate chains in which the last certificate is an arbitrary trusted, self-signed certificate. This may allow a remote unprivileged user to carry out man-in-the-middle type of attacks using forged serer certificates.

Evolution(evolution(1)) and Remote Desktop Applications are examples of applications which use this vulnerable library.

This vulnerability is also described in the following document:

• CVE-2008-4989 at: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4989
  

Permalink |