Home page logo

fulldisclosure logo Full Disclosure mailing list archives

Re: Mutt: failure to check server certificate in SMTP TLS connection
From: Honza Horak <hhorak () redhat com>
Date: Tue, 22 Mar 2011 09:29:44 +0100

On 9 March 2011 16:41, Tim<tim-security at sentinelchicken.org  
<https://lists.grok.org.uk/mailman/listinfo/full-disclosure>>  wrote:

It also turns out that I didn't test this issue enough. As I didn't
test with both gnutls and openssl. I only tested with gnutls. Mutt
actually works as I would expect with imaps, smtps and smtp -- with
starttls connection when using openssl. mutt appears to  be _broken_
when using gnutls for imaps, smtps and smtp -- with starttls. (on mutt 1.5.20).


I've tested this behaviour using both - gnutls and openssl - and it seems like the only difference is that there is an error printed using openssl: "Certificate host check failed: certificate owner does not match hostname imap.myhost.web".

In both cases a user can accept the certificate, but there is no warning about certificate's hostname mishmash using gnutls, which is a vulnerability.

I just wanted to sum up the issue, do I understand it correctly?


Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]