National Cyber-Alert System

Vulnerability Summary for CVE-2007-5770

Overview

The (1) Net::ftptls, (2) Net::telnets, (3) Net::imap, (4) Net::pop, and (5) Net::smtp libraries in Ruby 1.8.5 and 1.8.6 do not verify that the commonName (CN) field in a server certificate matches the domain name in a request sent over SSL, which makes it easier for remote attackers to intercept SSL transmissions via a man-in-the-middle attack or spoofed web site, different components than CVE-2007-5162.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

US-CERT Technical Alert: TA07-352A

Name: TA07-352A

Hyperlink:http://www.us-cert.gov/cas/techalerts/TA07-352A.html

External Source: REDHAT

Name: RHSA-2007:0965

Type: Patch Information

Hyperlink:http://www.redhat.com/support/errata/RHSA-2007-0965.html

External Source: SECUNIA

Name: 27673

Type: Advisory; Patch Information

Hyperlink:http://secunia.com/advisories/27673

External Source: MISC

Name: https://bugzilla.redhat.com/show_bug.cgi?id=362081

Hyperlink:https://bugzilla.redhat.com/show_bug.cgi?id=362081

External Source: SECTRACK

Name: 1018938

Hyperlink:http://www.securitytracker.com/id?1018938

External Source: BID

Name: 26421

Hyperlink:http://www.securityfocus.com/bid/26421

External Source: REDHAT

Name: RHSA-2007:0961

Hyperlink:http://www.redhat.com/support/errata/RHSA-2007-0961.html

External Source: SUSE

Name: SUSE-SR:2007:024

Hyperlink:http://www.novell.com/linux/security/advisories/2007_24_sr.html

External Source: MANDRIVA

Name: MDVSA-2008:029

Hyperlink:http://www.mandriva.com/security/advisories?name=MDVSA-2008:029

External Source: VUPEN

Name: ADV-2007-4238

Hyperlink:http://www.frsirt.com/english/advisories/2007/4238

External Source: DEBIAN

Name: DSA-1412

Hyperlink:http://www.debian.org/security/2007/dsa-1412

External Source: DEBIAN

Name: DSA-1411

Hyperlink:http://www.debian.org/security/2007/dsa-1411

External Source: DEBIAN

Name: DSA-1410

Hyperlink:http://www.debian.org/security/2007/dsa-1410

External Source: CONFIRM

Name: http://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=rev&revision=13656

Hyperlink:http://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=rev&revision=13656

External Source: SECUNIA

Name: 28645

Hyperlink:http://secunia.com/advisories/28645

External Source: SECUNIA

Name: 28136

Hyperlink:http://secunia.com/advisories/28136

External Source: SECUNIA

Name: 27818

Hyperlink:http://secunia.com/advisories/27818

External Source: SECUNIA

Name: 27769

Hyperlink:http://secunia.com/advisories/27769

External Source: SECUNIA

Name: 27764

Hyperlink:http://secunia.com/advisories/27764

External Source: SECUNIA

Name: 27756

Hyperlink:http://secunia.com/advisories/27756

External Source: SECUNIA

Name: 27576

Type: Advisory

Hyperlink:http://secunia.com/advisories/27576

External Source: SECUNIA

Name: 26985

Type: Advisory

Hyperlink:http://secunia.com/advisories/26985

External Source: APPLE

Name: APPLE-SA-2007-12-17

Hyperlink:http://lists.apple.com/archives/security-announce/2007/Dec/msg00002.html

External Source: CONFIRM

Name: http://docs.info.apple.com/article.html?artnum=307179

Hyperlink:http://docs.info.apple.com/article.html?artnum=307179

External Source: UBUNTU

Name: USN-596-1

Hyperlink:http://www.ubuntu.com/usn/usn-596-1

External Source: SECUNIA

Name: 29556

Hyperlink:http://secunia.com/advisories/29556