CVE-2011-4408

MediumCVSS 6.8/10Last modified Jun 16, 2026

Description

The Single Sign On Client (ubuntu-sso-client) for Ubuntu 11.04 and 11.10 does not properly validate SSL certificates when using HTTPS, which allows remote attackers to spoof a server and modify or read sensitive data via a man-in-the-middle (MITM) attack.

Metrics

CVSS 2.0 6.8/10AV:N/AC:M/Au:N/C:P/I:P/A:P

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://osvdb.org/82747
http://secunia.com/advisories/49448Vendor Advisory
http://www.securityfocus.com/bid/53829
http://www.ubuntu.com/usn/USN-1464-1Patch, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/76112
http://osvdb.org/82747
http://secunia.com/advisories/49448Vendor Advisory
http://www.securityfocus.com/bid/53829
http://www.ubuntu.com/usn/USN-1464-1Patch, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/76112

Timeline

Published: Jun 16, 2012
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2011

CVE-2011-44097.5The Ubuntu One Client for Ubuntu 10.04 LTS, 11.04, 11.10, and 12.04 LTS does not properly validate SSL certificates, which allows remote att CVE-2011-44151.2The ap_pregsub function in server/util.c in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x through 2.2.21, when the mod_setenvif modu CVE-2011-44316.5Directory traversal vulnerability in main.php in Merethis Centreon before 2.3.2 allows remote authenticated users to execute arbitrary comma CVE-2011-44325.0www/include/configuration/nconfigObject/contact/DB-Func.php in Merethis Centreon before 2.3.2 does not use a salt during calculation of a pa CVE-2011-44343.6Microsoft Windows Server 2008 R2 and R2 SP1 and Windows 7 Gold and SP1 do not properly enforce AppLocker rules, which allows local users to CVE-2011-44355.0The web-server component in the Consolidation and Analysis Engine (CAE) Server in DB2 Query Monitor in IBM DB2 Tools 2.3.0 for z/OS does not CVE-2011-44363.5Multiple cross-site scripting (XSS) vulnerabilities in the administrative web interface on the Dell KACE K2000 System Deployment Appliance a CVE-2011-44474.3The "encrypt wallet" feature in wxBitcoin and bitcoind 0.4.x before 0.4.1, and 0.5.0rc, does not properly interact with the deletion functio CVE-2011-44487.5SQL injection vulnerability in actions/usersettings/usersettings.php in WikkaWiki 1.3.1 and 1.3.2 allows remote attackers to execute arbitra CVE-2011-44496.8actions/files/files.php in WikkaWiki 1.3.1 and 1.3.2, when INTRANET_MODE is enabled, supports file uploads for file extensions that are typi CVE-2011-44506.4Directory traversal vulnerability in handlers/files.xml/files.xml.php in WikkaWiki 1.3.1 and 1.3.2 allows remote attackers to read or delete CVE-2011-44514.3libs/Wakka.class.php in WikkaWiki 1.3.1 and 1.3.2, when the spam_logging option is enabled, allows remote attackers to write arbitrary PHP c