Ubuntu
evolution-data-server package

evolution calendar does not check SSL certificates

Bug #933659 reported by Vreixo Formoso on 2012-02-16

270

This bug affects 3 people

	Status	Importance	Assigned to
evolution-data-server	Fix Released	Critical	gnome-bugs #671537
evolution-data-server (Ubuntu)	Fix Released	Undecided	Unassigned
evolution-data-server (openSUSE)	Won't Fix	High	novell-bugs #760517

Bug Description

When using a google calendar in evolution, evolution uses HTTPS. However, certificate correctness is not checked. Using a tool like sslsniff allows to capture user name and password. Given the calendar is periodically updated, it is trivial for an attacker to retrieve user private data when connected to the same local network.

Tags:

Revision history for this message

Vreixo Formoso (metalpain2002) wrote on 2012-02-16:

It seems a libsoup bug.

Revision history for this message

Marc Deslauriers (mdeslaur) wrote on 2012-02-16:

Evolution needs to tell libsoup to check the cert.

Revision history for this message

Vreixo Formoso (metalpain2002) wrote on 2012-02-16:

In e-cal-backend-caldav.c, line 4805, there is a call to soup_session_sync_new(). Afaik, it should be instead a call to soup_session_sync_new_with_options(), passing the SOUP_SESSION_SSL_CA_FILE pointing to the file where CA certificates are stored.

As explained clearly in http://developer.gnome.org/libsoup/stable/libsoup-client-howto.html, without such option "all SSL certificates will be accepted automatically".

Revision history for this message

Vreixo Formoso (metalpain2002) wrote on 2012-02-16:

Changing such line with:

cbdav->priv->session = soup_session_sync_new_with_options(SOUP_SESSION_SSL_CA_FILE, "/etc/ssl/certs/ca-certificates.crt");

should fix the problem, but I have not tested it yet, and, additionally, I have never used the libsoup library before, so I might be wrong.

Revision history for this message

Vreixo Formoso (metalpain2002) wrote on 2012-02-22:

There is another call in e-cal-backend-http with the same bug, this time the function used is soup_session_async_new(), and I think it should be soup_session_async_new_with_options(SOUP_SESSION_SSL_CA_FILE, "/etc/ssl/certs/ca-certificates.crt") instead. However, it does not fix the bug.

No idea whether this is the right way to pass the certificates to libsoup, or I'm missing a different call in the code.

Anyway, is anybody looking at this? I think it is a critical bug, as it allows recovering the google account user and password without effort. Many people keeps important data in his/her google account!

Revision history for this message

Vreixo Formoso (metalpain2002) wrote on 2012-02-22:

The bug also affects google integration with the address book. I hope to have a fix ready soon.

Revision history for this message

Vreixo Formoso (metalpain2002) wrote on 2012-02-22:

check-ssl-certificates.patch Edit (2.3 KiB, text/plain)

I attach a patch that fixes the problem on Natty. Note that the problem in the address book requires to patch libgdata. I will create a bug for it.

Revision history for this message

Marc Deslauriers (mdeslaur) wrote on 2012-02-22:

Thanks for the patch!

Revision history for this message

Marc Deslauriers (mdeslaur) wrote on 2012-02-22:

I'll take a closer look at the patches once you've looked at the address book too.

Revision history for this message

Vreixo Formoso (metalpain2002) wrote on 2012-02-22:

#10

Libgdata bug was reported as #938812. Report includes patch. Please verify. Note that the wrong libsoup usage seems to affect several ubuntu applications (I'm looking at empathy with telepathy-gabble in the next hours, I will report the bug if needed).

Jamie Strandboge (jdstrand) on 2012-02-24

Changed in evolution-data-server (Ubuntu):
status:	New → Confirmed

Revision history for this message

Marc Deslauriers (mdeslaur) wrote on 2012-03-06:

#11

I've sent the report upstream, thanks.

Bug Watch Updater (bug-watch-updater) on 2012-04-24

Changed in evolution-data-server:
importance:	Unknown → Critical
status:	Unknown → Fix Released

Revision history for this message

In Novell/SUSE Bugzilla #760517, Meissner-i (meissner-i) wrote on 2012-05-03:

#15

+++ This bug was initially created as a clone of Bug #758431 (libsoup) +++

As libsoup needs to be set to "strict ssl" and fed a ca path before it does
correct SSL checking, evolution-data-server is likely not doing SSL certificate
checking correctly.

Soup users I spotted:

Groupwise protocol handling (server/groupwise/e-gw-connection.c)
Exchange protocol handling (server/exchange/lib/e2k-context.c)
Google (servers/google/libgdata-google/gdata-google-service.c)
calendar/backends/http/e-cal-backend-http.c
calendar/backends/caldav/e-cal-backend-caldav.c

From Midori fix:
g_object_set (session,
"ssl-ca-file", "/etc/ssl/ca-bundle.pem",
"ssl-strict", TRUE
);

(e-d-s needs some handling of SSL cert verification failures though, otherwise it will just failt.)

Revision history for this message

In Novell/SUSE Bugzilla #760517, Meissner-i (meissner-i) wrote on 2012-05-03:

#16

(my suggestion is probably not correct... I do not fully understand it yet)

we probably need to evluated the "trusted" attribute after the connect

Revision history for this message

In Novell/SUSE Bugzilla #760517, Meissner-i (meissner-i) wrote on 2012-05-03:

#17

opened https://bugzilla.gnome.org/show_bug.cgi?id=675378

Revision history for this message

In Novell/SUSE Bugzilla #760517, Swamp-a (swamp-a) wrote on 2012-05-03:

#18

bugbot adjusting priority

Revision history for this message

In Novell/SUSE Bugzilla #760517, Meissner-i (meissner-i) wrote on 2012-05-04:

#19

A GNOME bug was already open:

https://bugzilla.gnome.org/show_bug.cgi?id=671537

It has patches for the non-groupwise parts already.

Revision history for this message

Steve Beattie (sbeattie) wrote on 2012-05-04:

#12

Making this report public since the issue is public elsewhere:

https://bugzilla.gnome.org/show_bug.cgi?id=671537
http://www.openwall.com/lists/oss-security/2012/05/04/4

visibility:

private → public

Revision history for this message

Ubuntu Foundations Team Bug Bot (crichton) wrote on 2012-05-04:

#13

The attachment "check-ssl-certificates.patch" of this bug report has been identified as being a patch. The ubuntu-reviewers team has been subscribed to the bug report so that they can review the patch. In the event that this is in fact not a patch you can resolve this situation by removing the tag 'patch' from the bug report and editing the attachment so that it is not flagged as a patch. Additionally, if you are member of the ubuntu-reviewers team please also unsubscribe the team from this bug report.

[This is an automated message performed by a Launchpad user owned by Brian Murray. Please contact him regarding any issues with the action taken in this bug report.]

tags:

added: patch

Revision history for this message

In Novell/SUSE Bugzilla #760517, Meissner-i (meissner-i) wrote on 2012-05-31:

#20

to bnc-team-evolution

Revision history for this message

Robie Basak (racb) wrote on 2012-06-24:

#14

Upstream fixes:

http://git.gnome.org/browse/evolution-data-server/commit/?id=969ea449d30be94f92feaa9ae5a18f83e68b2035
http://git.gnome.org/browse/evolution/commit/?id=12256b4f1cc7def560824ed5fb3c506669709a32

These went into 3.5. Precise is 3.2.3-0ubuntu6 and Quantal on 3.4.3-1ubuntu1.

Bug Watch Updater (bug-watch-updater) on 2012-06-24

Changed in evolution-data-server (openSUSE):
importance:	Unknown → High
status:	Unknown → Confirmed

Revision history for this message

Marc Deslauriers (mdeslaur) wrote on 2012-06-26:

#21

In theory, this should by addressed by a security update. The problem is that adding a new option may break existing users who are using self-signed certs. We may want to default to accepting invalid certs in the security update.

Marc Deslauriers (mdeslaur) on 2012-06-29

Changed in evolution-data-server (Ubuntu):
assignee:	nobody → Marc Deslauriers (mdeslaur)

Marc Deslauriers (mdeslaur) on 2012-10-15

Changed in evolution-data-server (Ubuntu):
assignee:	Marc Deslauriers (mdeslaur) → nobody

Revision history for this message

In Novell/SUSE Bugzilla #760517, Mweckbecker-g (mweckbecker-g) wrote on 2012-10-30:

#22

This bug confuses me a bit. Is it a Major VUL-0 issue (i.e. requires immediate
actions) or VUL-1 / planned update?

Revision history for this message

In Novell/SUSE Bugzilla #760517, Meissner-i (meissner-i) wrote on 2013-01-11:

#23

- missing certificate checking is bad ... however ...

- several services might run self-signed, including some Novell Groupwise installations, so compatibility would break when we enable it.

- so this might need UI additions to enable/disable cert checking, which in turn might get denied.

I suspect we might not be able to fix this easily at all and/or only in future products. :(

I am changing this to VUL-1.

Revision history for this message

In Novell/SUSE Bugzilla #760517, Projectnov-suse (projectnov-suse) wrote on 2013-02-28:

#24

Hi,

Setting the status to ASSIGNED.

Siarhei Melnikovich

Bug Watch Updater (bug-watch-updater) on 2013-03-01

Changed in evolution-data-server (openSUSE):
status:	Confirmed → In Progress

Revision history for this message

In Novell/SUSE Bugzilla #760517, Projectnov-suse (projectnov-suse) wrote on 2013-03-29:

#25

Hello,

work for fixing this bug is still in process. The fixes will The fixes will be backported from Evolution 3.3.*: https://bugzilla.gnome.org/show_bug.cgi?id=671537.

New option for strict certificate processing will be included in the UI.

Siarhei Melnikovich.

Revision history for this message

In Novell/SUSE Bugzilla #760517, Projectnov-suse (projectnov-suse) wrote on 2013-04-26:

#26

Hello,

The evolution-data-server package is now ready. Evolution is modified to make use of "strict ssl"; however, a UI option for Evolution is still a problem and requires more effort since 3.3 and 2.x code is quite different.

Siarhei Melnikovich

Revision history for this message

In Novell/SUSE Bugzilla #760517, Projectnov-suse (projectnov-suse) wrote on 2013-06-07:

#27

Hello,

===
There is an update on this issue.

It looks like the only fix possible for this bug is "libsoup strict SSL mode enabled". In Evolution 2.x, all of the certificate authenticity checks are done within calendar/gui/itip-utils.c:itip_public_comp inside the backend; no extra configuration options may be passed and it is complicated to implement the latter. In addition, in Evolution 3.x things are very different and cannot be easily ported back into version 2.x.

With "strict mode" in libsoup enabled, end-users will have to add unverified certificates they trust into the system using the external tools.

Siarhei Melnikovich

Revision history for this message

In Novell/SUSE Bugzilla #760517, Projectnov-suse (projectnov-suse) wrote on 2013-06-28:

#28

Hi,

Documenting the results of discussion with Michael Haefner:

The risk of breaking the existing things is not worth the effort. The status is now set to RESOLVED WONTFIX.

--
Sergei

Bug Watch Updater (bug-watch-updater) on 2013-07-04

Changed in evolution-data-server (openSUSE):
status:	In Progress → Won't Fix

Revision history for this message

Marc Deslauriers (mdeslaur) wrote on 2015-03-26:

#29

This is fixed in Ubuntu 14.04 LTS and above, and older versions will not get updated because it may break existing installation.
I'm marking this bug as fixed.