Bug 873906 (CVE-2011-5241)

Summary:	CVE-2011-5241 php-pear-Service-Twitter: does not verify that a server hostname matches a domain name in the CN or subjectAltName field of X.509 certs
Product:	[Other] Security Response	Reporter:	Vincent Danen <vdanen>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	fedora
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-10-19 21:57:39 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	873907, 873908
Bug Blocks:

Description Vincent Danen 2012-11-06 23:02:10 UTC

Common Vulnerabilities and Exposures assigned an identifier CVE-2011-5241 to
the following vulnerability:

Name: CVE-2011-5241
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-5241
Assigned: 20121106
Reference: http://www.unrest.ca/peerjacking

Services_Twitter 0.6.3 does not verify that the server hostname
matches a domain name in the subject's Common Name (CN) or
subjectAltName field of the X.509 certificate, which allows
man-in-the-middle attackers to spoof SSL servers via an arbitrary
valid certificate.

Comment 1 Vincent Danen 2012-11-06 23:05:45 UTC

The flawed code is in Services/Twitter.php:

489     public function getRequest()
...
494         if ($this->getOption('use_ssl')) {                                                                                                                                                                                                                                  
495             // XXX ssl won't work with ssl_verify_peer set to true, which is.
496             // the default in HTTP_Request2
497             $this->request->setConfig('ssl_verify_peer', false);
498         }
499         return $this->request;

So even if it's configured to use SSL, it won't.  Seems like the real problem might be in php-pear-HTTP-Request2, if the above comment is actually accurate for the currently shipped version.

Comment 2 Vincent Danen 2012-11-06 23:06:29 UTC

Created php-pear-Services-Twitter tracking bugs for this issue

Affects: fedora-all [bug 873907]
Affects: epel-6 [bug 873908]

Comment 3 Vincent Danen 2012-11-13 15:36:01 UTC

Sorry, this should be 2011, not 2012.