Bug 359257 – net-mail/mutt: SMTP TLS Certificate Security Bypass Vulnerability (CVE-2011-1429)

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Paweł Hajdan, Jr. (RETIRED) 2011-03-17 10:17:54 UTC]

Mutt does not verify that the smtps server hostname matches the domain name of the subject of an X.509 certificate, which allows man-in-the-middle attackers to spoof an SSL SMTP server via an arbitrary certificate, a different vulnerability than CVE-2009-3766.

http://seclists.org/fulldisclosure/2011/Mar/87

[Comment 1 Fabian Groffen 2011-03-17 10:43:04 UTC]

Ok, this issue is reduced to gnutls only.  I'm fine with masking the gnutls USE-flag until a patch from upstream is submitted.

I think this corresponds to upstream bug
http://dev.mutt.org/trac/ticket/3506

[Comment 2 GLSAMaker/CVETool Bot 2011-06-20 18:39:37 UTC]

CVE-2011-1429 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-1429):
  Mutt does not verify that the smtps server hostname matches the domain name
  of the subject of an X.509 certificate, which allows man-in-the-middle
  attackers to spoof an SSL SMTP server via an arbitrary certificate, a
  different vulnerability than CVE-2009-3766.

[Comment 3 Chris Reffett (RETIRED) 2013-09-03 18:30:56 UTC]

Patch available at [1], not sure if it's in any current mutt versions.
[1] http://dev.mutt.org/trac/changeset/d7f4b2e2b09a

[Comment 4 Fabian Groffen 2013-09-03 18:48:26 UTC]

nope it's not in, we'll have to pick that one

[Comment 5 Fabian Groffen 2013-09-09 19:15:45 UTC]

this should be in 1.5.21-r13

[Comment 6 Sergey Popov 2014-06-05 08:49:44 UTC]

Covered by GLSA 201406-05