The IMAP-over-SSL implementation in getmail 4.0.0 through 4.43.0 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof IMAP servers and obtain sensitive information via a crafted certificate.

Several vulnerabilities have been discovered in getmail4, a mail retriever with support for POP3, IMAP4 and SDPS, that could allow man-in-the-middle attacks.

CVE-2014-7273

The IMAP-over-SSL implementation in getmail 4.0.0 through 4.43.0 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof IMAP servers and obtain sensitive information via a crafted certificate.

CVE-2014-7274

The IMAP-over-SSL implementation in getmail 4.44.0 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) field of the X.509 certificate, which allows man-in-the-middle attackers to spoof IMAP servers and obtain sensitive information via a crafted certificate from a recognized Certification Authority.

CVE-2014-7275

The POP3-over-SSL implementation in getmail 4.0.0 through 4.44.0 does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof POP3 servers and obtain sensitive information via a crafted certificate.

For the squeeze distribution, those problems have been fixed by importing a new upstream version: 4.46.0-1~deb6u1. The updated package has been prepared by Osamu Aoki.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201412-50 (getmail: Information disclosure)

    Multiple vulnerabilities have been discovered in getmail. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could cause a man-in-the-middle attack via multiple       vectors to obtain sensitive information.
  Workaround :

    There is no known workaround at this time.

Several vulnerabilities have been discovered in getmail4, a mail retriever with support for POP3, IMAP4 and SDPS, that could allow man-in-the-middle attacks.

  - CVE-2014-7273     The IMAP-over-SSL implementation in getmail 4.0.0     through 4.43.0 does not verify X.509 certificates from     SSL servers, which allows man-in-the-middle attackers to     spoof IMAP servers and obtain sensitive information via     a crafted certificate.

  - CVE-2014-7274     The IMAP-over-SSL implementation in getmail 4.44.0 does     not verify that the server hostname matches a domain     name in the subject's Common Name (CN) field of the     X.509 certificate, which allows man-in-the-middle     attackers to spoof IMAP servers and obtain sensitive     information via a crafted certificate from a recognized     Certification Authority.

  - CVE-2014-7275     The POP3-over-SSL implementation in getmail 4.0.0     through 4.44.0 does not verify X.509 certificates from     SSL servers, which allows man-in-the-middle attackers to     spoof POP3 servers and obtain sensitive information via     a crafted certificate.

- getmail 4.46.0 [bnc#900217] This release fixes several     similar vulnerabilities that could allow a     man-in-the-middle attacker to read encrypted traffic due     to pack of certificate verification against the     hostname.

  - fix --idle checking Python version incorrectly,     resulting in incorrect warning about running with Python     < 2.5

  - add missing support for SSL certificate checking in POP3     which broke POP retrieval in v4.45.0 [CVE-2014-7275]

  - includes changes from 4.45.0 :

  - perform hostname-vs-certificate matching of SSL     certificate if validating the certifcate [CVE-2014-7274]

  - fix missing plaintext versions of documentation

  - includes changes from 4.44.0 :

  - add extended SSL options for IMAP retrievers, allowing     certificate verification and other features     [CVE-2014-7273]

  - fix missing plaintext versions of documentation

  - fix 'Header instance has no attribute 'strip'' error     which cropped up in some configurations

ID	Name	Product	Family	Severity
82090	Debian DLA-106-1 : getmail4 security update	Nessus	Debian Local Security Checks	medium
80271	GLSA-201412-50 : getmail: Information disclosure	Nessus	Gentoo Local Security Checks	medium
79805	Debian DSA-3091-1 : getmail4 - security update	Nessus	Debian Local Security Checks	medium
78635	openSUSE Security Update : getmail (openSUSE-SU-2014:1315-1)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2014-7273

medium

Tenable Plugins

medium

medium

medium

medium