Mutt 'mutt_ssl.c' X.509 Certificate Chain Security Bypass Vulnerability

Bugtraq ID:	35288
Class:	Design Error
CVE:	CVE-2009-1390
Remote:	Yes
Local:	No
Published:	Jun 10 2009 12:00AM
Updated:	Apr 13 2015 09:55PM
Credit:	Miroslav Lichvar
Vulnerable:	Mutt Mutt 1.5.19
Not Vulnerable:

Mutt 'mutt_ssl.c' X.509 Certificate Chain Security Bypass Vulnerability

Mutt is prone to a security-bypass vulnerability because the application fails to properly validate chained X.509 certificates.

Successfully exploiting this issue allows attackers to perform man-in-the-middle attacks by impersonating trusted servers. Unsuspecting users may be under a false sense of security that can aid attackers in launching further attacks.

Mutt 1.5.19 is vulnerable.

Mutt 'mutt_ssl.c' X.509 Certificate Chain Security Bypass Vulnerability

An attacker can use readily available networking tools to exploit this issue.

Mutt 'mutt_ssl.c' X.509 Certificate Chain Security Bypass Vulnerability

Solution:
Updates are available. Please see the references for more information.

Mutt 'mutt_ssl.c' X.509 Certificate Chain Security Bypass Vulnerability

References:

• Fix TLS certificate chain validation for openssl. (Brendan Cully)
  
• Mutt 1.5.19 SSL chain verification flaw (Tomas Hoger)
  
• Mutt Homepage (Mutt)