Mutt does not verify that the smtps server hostname matches the domain name of the subject of an X.509 certificate, which allows man-in-the-middle attackers to spoof an SSL SMTP server via an arbitrary certificate, a different vulnerability than CVE-2009-3766.

The remote Oracle Linux 6 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2011-0959 advisory.

    [1.5.20-2.20091214hg736b6a.el6_1.1]
    - Fixed hostname verification of x.509 certificates.
      Resolves: #716889 (CVE-2011-1429)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Mutt is a text-mode mail user agent.

A flaw was found in the way Mutt verified SSL certificates. When a server presented an SSL certificate chain, Mutt could ignore a server hostname check failure. A remote attacker able to get a certificate from a trusted Certificate Authority could use this flaw to trick Mutt into accepting a certificate issued for a different hostname, and perform man-in-the-middle attacks against Mutt's SSL connections.
(CVE-2011-1429)

All Mutt users should upgrade to this updated package, which contains a backported patch to correct this issue. All running instances of Mutt must be restarted for this update to take effect.

Dave B reports on Full Disclosure :

It seems that mutt fails to check the validity of a SMTP servers certificate during a TLS connection. [...] This means that an attacker could potentially MITM a mutt user connecting to their SMTP server even when the user has forced a TLS connection.

A vulnerability has been found and corrected in mutt :

Mutt does not verify that the smtps server hostname matches the domain name of the subject of an X.509 certificate, which allows man-in-the-middle attackers to spoof an SSL SMTP server via an arbitrary certificate, a different vulnerability than CVE-2009-3766 (CVE-2011-1429).

The updated packages have been patched to correct this issue.

It was discovered that mutt incorrectly verified the hostname in an SSL certificate. An attacker could trick mutt into trusting a rogue SMTPS, IMAPS, or POP3S server's certificate, which was signed by a trusted certificate authority, to perform a man-in-the-middle attack.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 6 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2011:0959 advisory.

  - mutt: SSL host name check may be skipped when verifying certificate chain (CVE-2011-1429)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This is an update that fixes a hostname verification of x.509 certificates and a segmentation fault during reading message headers.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
68308	Oracle Linux 6 : mutt (ELSA-2011-0959)	Nessus	Oracle Linux Local Security Checks	medium
61085	Scientific Linux Security Update : mutt on SL6.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
58642	FreeBSD : mutt-devel -- failure to check SMTP TLS server certificate (49314321-7fd4-11e1-9582-001b2134ef46)	Nessus	FreeBSD Local Security Checks	medium
58575	Mandriva Linux Security Advisory : mutt (MDVSA-2012:048)	Nessus	Mandriva Local Security Checks	medium
56346	Ubuntu 10.04 LTS / 10.10 / 11.04 : mutt vulnerability (USN-1221-1)	Nessus	Ubuntu Local Security Checks	medium
55626	RHEL 6 : mutt (RHSA-2011:0959)	Nessus	Red Hat Local Security Checks	medium
55148	Fedora 13 : mutt-1.5.21-5.fc13 (2011-7756)	Nessus	Fedora Local Security Checks	medium
55058	Fedora 14 : mutt-1.5.21-5.fc14 (2011-7751)	Nessus	Fedora Local Security Checks	medium
55057	Fedora 15 : mutt-1.5.21-5.fc15 (2011-7739)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2011-1429

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium