[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Fri, 18 Nov 2011 16:47:35 +0200
From: Timo Sirainen <tss@....fi>
To: oss-security@...ts.openwall.com
Cc: "Steven M. Christey" <coley@...us.mitre.org>
Subject: Re: CVE Request -- Dovecot -- Validate certificate's CN against
requested remote server hostname when proxying
On Fri, 2011-11-18 at 14:37 +0100, Jan Lieskovsky wrote:
> a security flaw was found in the way Dovecot, an IMAP and POP3 email
> server, performed remote server identity verification (x509
> certificate's Common Name field was not checked to match provided
> remote server host name), when Dovecot was configured to proxy IMAP and
> POP3 connections to remote hosts and TLS/SSL protocols were requested
> (ssl=yes or starttls=yes) in the configuration to secure these
> connections to the destination server. A remote attacker could use
> this flaw to conduct man-in-the-middle (MITM) attacks via specially-
> crafted x509v3 certificate.
..
> But on the other hand, this change is important enough, to be
> backported to all affected versions,
SSL proxy connections were added in some Dovecot v1.x version, but v1.x
doesn't support giving hostname as proxy destination, only IP address.
So this can't really be backported to v1.x.
My v2.0 change keeps this backwards compatible with existing setups that
use IP addresses, so that the hostname check is skipped when connecting
with IP.
Upcoming v2.1 is stricter and doesn't skip the check, which basically
means that ssl=yes with IP address as destination always fails.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
