unity-lens-shopping

Potential MitM Flaw in Unity Shopping Lens

Bug #1073085 reported by Benjamin Kerensa
260
This bug affects 1 person
Affects Status Importance Assigned to Milestone
unity-lens-shopping
Expired
Undecided
Unassigned

Bug Description

Currently Unity Shopping Lens uses Libsoup which does not do Ceritificate Validation so their appears to be a potential for a MitM attack if DNS Poisoning on the LAN occurs and packets are intercepted and a fake certificate is sent along with bad results.

Revision history for this message
Marc Deslauriers (mdeslaur) wrote :

I can't reproduce this.

I see the following code in scope.vala which enables cert checking:
      session.ssl_use_system_ca_file = true;
      session.ssl_strict = true;

And attempting to MITM using sslsniff and an invalid cert shows no results in the dash.

Please give detailed steps on how to reproduce this issue.

Changed in unity-lens-shopping:
status: New → Incomplete
Marc Deslauriers (mdeslaur)
information type: Private Security → Public Security
Revision history for this message
Launchpad Janitor (janitor) wrote :

[Expired for unity-lens-shopping because there has been no activity for 60 days.]

Changed in unity-lens-shopping:
status: Incomplete → Expired
To post a comment you must log in.
This report contains Public Security information  
Everyone can see this security related information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.