full-disclosure - Re: Mutt: failure to check server certificate in SMTP TLS connection

Open Source and information security mailing list archives

Message-ID: <4D885DF8.700@redhat.com>
Date: Tue, 22 Mar 2011 09:29:44 +0100
From: Honza Horak <hhorak@...hat.com>
To: full-disclosure@...ts.grok.org.uk
Subject: Re: Mutt: failure to check server certificate in
 SMTP TLS connection

> On 9 March 2011 16:41, Tim<tim-security at sentinelchicken.org  <https://lists.grok.org.uk/mailman/listinfo/full-disclosure>>  wrote:
>
> It also turns out that I didn't test this issue enough. As I didn't
> test with both gnutls and openssl. I only tested with gnutls. Mutt
> actually works as I would expect with imaps, smtps and smtp -- with
> starttls connection when using openssl. mutt appears to  be _broken_
> when using gnutls for imaps, smtps and smtp -- with starttls. (on mutt 1.5.20).

Hi,

I've tested this behaviour using both - gnutls and openssl - and it 
seems like the only difference is that there is an error printed using 
openssl: "Certificate host check failed: certificate owner does not 
match hostname imap.myhost.web".

In both cases a user can accept the certificate, but there is no warning 
about certificate's hostname mishmash using gnutls, which is a 
vulnerability.

I just wanted to sum up the issue, do I understand it correctly?

Honza

<javascript:void(0);>

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives