CVE-2007-5770

原文の説明

The (1) Net::ftptls, (2) Net::telnets, (3) Net::imap, (4) Net::pop, and (5) Net::smtp libraries in Ruby 1.8.5 and 1.8.6 do not verify that the commonName (CN) field in a server certificate matches the domain name in a request sent over SSL, which makes it easier for remote attackers to intercept SSL transmissions via a man-in-the-middle attack or spoofed web site, different components than CVE-2007-5162.

影響を受けるソフトウェア

• Ruby = 1.8.6= 1.8.5 完全一致

詳細

公開日

2007-11-14

最終更新

2024-08-08

CVSS ベクター

AV:N/AC:L/Au:N/C:N/I:P/A:N

参考資料

• cve.org/CVE-2007-5770
• nvd.nist.gov/vuln/detail/CVE-2007-5770
• secunia.com/advisories/27576
• www.vupen.com/english/advisories/2007/4238
• secunia.com/advisories/26985
• www.us-cert.gov/cas/techalerts/TA07-352A.html
• secunia.com/advisories/28136
• www.ubuntu.com/usn/usn-596-1
• bugzilla.redhat.com/show_bug.cgi?id=362081
• www.redhat.com/support/errata/RHSA-2007-0961.html
• www.redhat.com/support/errata/RHSA-2007-0965.html
• secunia.com/advisories/27756
• www.debian.org/security/2007/dsa-1412
• secunia.com/advisories/27673