Ubuntu Security Notice 1547-1 - Vreixo Formoso discovered that the libGData library, as used by Evolution and other applications, did not properly verify SSL certificates. A remote attacker could exploit this to perform a man in the middle attack to view sensitive information or alter data transmitted via the GData protocol.
a4ab1606db51fda6b3872f4eb812e94c816f2b0d3a0230277fcb0126b714fb2a
Content-Disposition: inline
==========================================================================Ubuntu Security Notice USN-1547-1
August 28, 2012
libgdata, evolution-data-server vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 11.10
- Ubuntu 11.04
- Ubuntu 10.04 LTS
Summary:
Applications using GData services could be made to expose sensitive
information over the network.
Software Description:
- libgdata: Library to access GData services
- evolution-data-server: Evolution suite data server
Details:
Vreixo Formoso discovered that the libGData library, as used
by Evolution and other applications, did not properly verify SSL
certificates. A remote attacker could exploit this to perform a man
in the middle attack to view sensitive information or alter data
transmitted via the GData protocol.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 11.10:
libgdata13 0.9.1-0ubuntu2.1
Ubuntu 11.04:
libgdata11 0.8.0-0ubuntu1.1
Ubuntu 10.04 LTS:
libgdata-google1.2-1 2.28.3.1-0ubuntu6.1
libgdata1.2-1 2.28.3.1-0ubuntu6.1
libgdata6 0.5.2-0ubuntu1.1
In general, a standard system update will make all the necessary changes.
References:
http://www.ubuntu.com/usn/usn-1547-1
CVE-2012-1177
Package Information:
https://launchpad.net/ubuntu/+source/libgdata/0.9.1-0ubuntu2.1
https://launchpad.net/ubuntu/+source/libgdata/0.8.0-0ubuntu1.1
https://launchpad.net/ubuntu/+source/evolution-data-server/2.28.3.1-0ubuntu6.1
https://launchpad.net/ubuntu/+source/libgdata/0.5.2-0ubuntu1.1