CVE-2013-0289

Isync 0.4 before 1.0.6, does not verify that the server hostname matches a domain name in the subjects Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

Affected Software

Name	Vendor	Start Version	End Version
Isync	Isync_project	0.4 (including)	0.4 (including)
Isync	Isync_project	0.5 (including)	0.5 (including)
Isync	Isync_project	0.6 (including)	0.6 (including)
Isync	Isync_project	0.7 (including)	0.7 (including)
Isync	Isync_project	0.8 (including)	0.8 (including)
Isync	Isync_project	1.0.0 (including)	1.0.0 (including)
Isync	Isync_project	1.0.1 (including)	1.0.1 (including)
Isync	Isync_project	1.0.2 (including)	1.0.2 (including)
Isync	Isync_project	1.0.3 (including)	1.0.3 (including)
Isync	Isync_project	1.0.4 (including)	1.0.4 (including)
Isync	Isync_project	1.0.5 (including)	1.0.5 (including)
Isync	Ubuntu	artful	*
Isync	Ubuntu	hardy	*
Isync	Ubuntu	lucid	*
Isync	Ubuntu	oneiric	*
Isync	Ubuntu	precise	*
Isync	Ubuntu	quantal	*
Isync	Ubuntu	raring	*
Isync	Ubuntu	saucy	*
Isync	Ubuntu	upstream	*
Isync	Ubuntu	utopic	*
Isync	Ubuntu	vivid	*
Isync	Ubuntu	wily	*
Isync	Ubuntu	yakkety	*
Isync	Ubuntu	zesty	*

NVD	https://nvd.nist.gov/vuln/detail/CVE-2013-0289
CWE	https://cwe.mitre.org/data/definitions/310.html

Affected Software

References