Date: Fri, 18 Nov 2011 16:47:35 +0200 From: Timo Sirainen <tss@....fi> To: oss-security@...ts.openwall.com Cc: "Steven M. Christey" <coley@...us.mitre.org> Subject: Re: CVE Request -- Dovecot -- Validate certificate's CN against requested remote server hostname when proxying On Fri, 2011-11-18 at 14:37 +0100, Jan Lieskovsky wrote: > a security flaw was found in the way Dovecot, an IMAP and POP3 email > server, performed remote server identity verification (x509 > certificate's Common Name field was not checked to match provided > remote server host name), when Dovecot was configured to proxy IMAP and > POP3 connections to remote hosts and TLS/SSL protocols were requested > (ssl=yes or starttls=yes) in the configuration to secure these > connections to the destination server. A remote attacker could use > this flaw to conduct man-in-the-middle (MITM) attacks via specially- > crafted x509v3 certificate. .. > But on the other hand, this change is important enough, to be > backported to all affected versions, SSL proxy connections were added in some Dovecot v1.x version, but v1.x doesn't support giving hostname as proxy destination, only IP address. So this can't really be backported to v1.x. My v2.0 change keeps this backwards compatible with existing setups that use IP addresses, so that the hostname check is skipped when connecting with IP. Upcoming v2.1 is stricter and doesn't skip the check, which basically means that ssl=yes with IP address as destination always fails.
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ