| Vulnerability Name: | CVE-2009-3766 (CCN-53163) | ||||||||
| Assigned: | 2009-09-10 | ||||||||
| Published: | 2009-09-10 | ||||||||
| Updated: | 2019-11-07 | ||||||||
| Summary: | mutt_ssl.c in mutt 1.5.16 and other versions before 1.5.19, when OpenSSL is used, does not verify the domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate. | ||||||||
| CVSS v3 Severity: | 5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
| ||||||||
| CVSS v2 Severity: | 6.8 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P) 5.0 Medium (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P/E:U/RL:OF/RC:C)
3.2 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N/E:U/RL:OF/RC:C)
| ||||||||
| Vulnerability Type: | CWE-310 | ||||||||
| Vulnerability Consequences: | Gain Access | ||||||||
| References: | Source: MITRE Type: CNA CVE-2009-3766 Source: CCN Type: Mutt Ticket #3087 No server hostname validation in SSL certificate processing Source: CONFIRM Type: Patch, Vendor Advisory http://dev.mutt.org/trac/ticket/3087 Source: MLIST Type: Mailing List, Third Party Advisory [oss-security] 20090903 More CVE-2009-2408 like issues Source: CCN Type: Mutt Web site The Mutt E-Mail Client Source: MLIST Type: Mailing List, Third Party Advisory [oss-security] 20091026 Re: More CVE-2009-2408 like issues Source: CCN Type: OSVDB ID: 59269 Mutt mutt_ssl.c Certificate Authority (CA) Common Name Domain Name Verification SSL MiTM Weakness Source: CCN Type: OSVDB ID: 73731 Mutt SMTP X.509 Certificate Common Name Field MiTM Weakness Source: CCN Type: BID-36251 Mutt SSL Certificate Validation Security Bypass Vulnerability Source: XF Type: UNKNOWN mutt-commonname-spoofing(53163) | ||||||||
| Vulnerable Configuration: | Configuration 1: Denotes that component is vulnerable | ||||||||
| BACK | |||||||||