OfflineIMAP SSL Certificate Validation Security Bypass Vulnerability

Bugtraq ID:	45561
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Dec 23 2010 12:00AM
Updated:	Dec 23 2010 12:00AM
Credit:	david b.
Vulnerable:	OfflineIMAP OfflineIMAP 6.3.1
Not Vulnerable:

OfflineIMAP SSL Certificate Validation Security Bypass Vulnerability

OfflineIMAP is prone to a security-bypass vulnerability because the application fails to properly validate SSL certificates.

Successfully exploiting this issue allows attackers to perform man-in-the-middle attacks or impersonate trusted servers, which will aid in further attacks.

OfflineIMAP 6.3.1 is vulnerable; other versions may also be affected.

OfflineIMAP SSL Certificate Validation Security Bypass Vulnerability

An attacker can use readily available network utilities to exploit this issue.

OfflineIMAP SSL Certificate Validation Security Bypass Vulnerability

Solution:
Updates are available. Please see the references for more information.

OfflineIMAP SSL Certificate Validation Security Bypass Vulnerability

References:

• #603450 offlineimap: fails check the remote servers ssl certificate is valid (david b)
  
• Bug 665382 - OfflineIMAP: Doesn't check SSL server certificate (Jan Lieskovsky)
  
• CVE Request -- OfflineIMAP -- 1), failed to validate remote SSL server certifica (Jan Lieskovsky)
  
• Implement SSL certificate checking (nicolas33)
  
• OfflineIMAP Homepage (OfflineIMAP)