Isync 0.4 before 1.0.6, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

The remote host is affected by the vulnerability described in GLSA-201310-02 (isync: Man-in-the-Middle attack)

    isync does not properly verify the server&rsquo;s hostname against the CN       field in the SSL certificate.
  Impact :

    A remote server could perform man-in-the-middle attacks to disclose       passwords or obtain other sensitive information.
  Workaround :

    There is no known workaround at this time.

- Wed Feb 20 2013 Fabian Affolter <mail at     fabian-affolter.ch> 1.0.6-1 - Updated to new upstream     version 1.0.6

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
70308	GLSA-201310-02 : isync: Man-in-the-Middle attack	Nessus	Gentoo Local Security Checks	medium
64979	Fedora 18 : isync-1.0.6-1.fc18 (2013-2795)	Nessus	Fedora Local Security Checks	medium
64975	Fedora 17 : isync-1.0.6-1.fc17 (2013-2758)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2013-0289

medium

Tenable Plugins

medium

medium

medium