Vulnerability Description
The ssl_do_connect function in common/server.c in HexChat before 2.10.2, XChat, and XChat-GNOME does not verify that the server hostname matches a domain name in the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Canonical | Ubuntu Linux | 12.04 |
| Xchat | Xchat | - |
| Xchat | Xchat Gnome | - |
| Hexchat Project | Hexchat | <= 2.10.1 |
Related Weaknesses (CWE)
References
- http://hexchat.readthedocs.org/en/latest/changelog.htmlVendor Advisory
- http://www.ubuntu.com/usn/USN-2945-1
- https://bugzilla.redhat.com/show_bug.cgi?id=1081839
- https://github.com/hexchat/hexchat/commit/c9b63f7f9be01692b03fa15275135a4910a7e0
- https://github.com/hexchat/hexchat/issues/524
- http://hexchat.readthedocs.org/en/latest/changelog.htmlVendor Advisory
- http://www.ubuntu.com/usn/USN-2945-1
- https://bugzilla.redhat.com/show_bug.cgi?id=1081839
- https://github.com/hexchat/hexchat/commit/c9b63f7f9be01692b03fa15275135a4910a7e0
- https://github.com/hexchat/hexchat/issues/524
FAQ
What is CVE-2013-7449?
CVE-2013-7449 is a vulnerability with a CVSS score of 6.5 (MEDIUM). The ssl_do_connect function in common/server.c in HexChat before 2.10.2, XChat, and XChat-GNOME does not verify that the server hostname matches a domain name in the X.509 certificate, which allows ma...
How severe is CVE-2013-7449?
CVE-2013-7449 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2013-7449?
Check the references section above for vendor advisories and patch information. Affected products include: Canonical Ubuntu Linux, Xchat Xchat, Xchat Xchat Gnome, Hexchat Project Hexchat.