CVE-2015-3886
📋 TL;DR
CVE-2015-3886 is a critical SSL certificate validation vulnerability in libinfinity that fails to check for expired certificates, allowing man-in-the-middle attacks. This affects applications using libinfinity for collaborative editing, primarily Gobby and other libinfinity-based tools. Attackers can intercept and manipulate encrypted communications between clients and servers.
💻 Affected Systems
- libinfinity
- Gobby
- Other applications using libinfinity library
📦 What is this software?
Libinfinity by Libinfinity Project
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of encrypted communications allowing data interception, manipulation, and credential theft in collaborative editing sessions.
Likely Case
Man-in-the-middle attacks intercepting and potentially modifying collaborative editing sessions and shared documents.
If Mitigated
Limited impact if proper network segmentation and certificate pinning are implemented.
🎯 Exploit Status
Exploitation requires network position between client and server, but no authentication bypass needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: libinfinity 0.6.6-1 and later
Vendor Advisory: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=783601
Restart Required: Yes
Instructions:
1. Update libinfinity to version 0.6.6-1 or later using your distribution's package manager. 2. Restart any applications using libinfinity. 3. For Gobby, ensure you're using patched libinfinity library.
🔧 Temporary Workarounds
Network Segmentation
allIsolate libinfinity services to trusted network segments to reduce attack surface.
Certificate Pinning
allImplement certificate pinning in applications to validate specific certificates.
🧯 If You Can't Patch
- Disable SSL/TLS functionality in libinfinity if not required
- Use VPN or encrypted tunnels for all libinfinity communications
🔍 How to Verify
Check if Vulnerable:
Check libinfinity version: dpkg -l | grep libinfinity or rpm -qa | grep libinfinityCheck Version:
dpkg -l | grep libinfinity || rpm -qa | grep libinfinity || pkg-config --modversion libinfinityVerify Fix Applied:
Verify version is 0.6.6-1 or higher and test SSL certificate validation with expired certificates.📡 Detection & Monitoring
Log Indicators:
- Failed SSL handshakes with expired certificates being accepted
- Unusual network connections to libinfinity ports
Network Indicators:
- Man-in-the-middle attacks on port 6523 (default Gobby port)
- SSL/TLS traffic interception patterns
SIEM Query:
source="*libinfinity*" AND (event="ssl_handshake" OR event="certificate_validation")🔗 References
- http://seclists.org/oss-sec/2015/q2/410
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=783601
- https://bugzilla.redhat.com/show_bug.cgi?id=1221266
- https://github.com/gobby/gobby/issues/61
- https://github.com/gobby/libinfinity/commit/c97f870f5ae13112988d9f8ad464b4f679903706
- http://seclists.org/oss-sec/2015/q2/410
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=783601
- https://bugzilla.redhat.com/show_bug.cgi?id=1221266
- https://github.com/gobby/gobby/issues/61
- https://github.com/gobby/libinfinity/commit/c97f870f5ae13112988d9f8ad464b4f679903706
