The libwww-perl LWP::Protocol::https module 6.04 through 6.06 for Perl, when using IO::Socket::SSL as the SSL socket class, allows attackers to disable server certificate validation via the (1) HTTPS_CA_DIR or (2) HTTPS_CA_FILE environment variable.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The libwww-perl LWP::Protocol::https module 6.04 through 6.06 for Perl, when using IO::Socket::SSL as the     SSL socket class, allows attackers to disable server certificate validation via the (1) HTTPS_CA_DIR or     (2) HTTPS_CA_FILE environment variable. (CVE-2014-3230)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Ubuntu 14.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-2292-1 advisory.

    It was discovered that the LWP::Protocol::https perl module incorrectly disabled peer certificate     verification completely when only hostname verification was requested to be disabled. If a remote attacker     were able to perform a machine-in-the-middle attack, this flaw could possibly be exploited in certain     scenarios to alter or compromise confidential information in applications that used the     LWP::Protocol::https module.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

perl-LWP-Protocol-https was updated to prevent a possible MITM if the environment variables HTTPS_CA_DIR or HTTPS_CA_FILE were set (CVE-2014-3230).

This release fixes a server certification validation when a certificate authority is defined by HTTPS_CA_DIR or HTTPS_CA_FILE environement variable.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
218069	Linux Distros Unpatched Vulnerability : CVE-2014-3230	Nessus	Misc.	medium
76587	Ubuntu 14.04 LTS : LWP::Protocol::https vulnerability (USN-2292-1)	Nessus	Ubuntu Local Security Checks	medium
75370	openSUSE Security Update : perl-LWP-Protocol-https (openSUSE-SU-2014:0710-1)	Nessus	SuSE Local Security Checks	medium
74169	Fedora 19 : perl-LWP-Protocol-https-6.04-2.fc19 (2014-6369)	Nessus	Fedora Local Security Checks	medium
74131	Fedora 20 : perl-LWP-Protocol-https-6.04-4.fc20 (2014-6303)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2014-3230

medium

Tenable Plugins

medium

medium

medium

medium

medium