Vulnerability CVE-2011-4318

Vulnerability Name:

CVE-2011-4318 (CCN-71354)

Assigned:

2011-11-17

Published:

2011-11-17

Updated:

2013-03-07

Summary:

Dovecot 2.0.x before 2.0.16, when ssl or starttls is enabled and hostname is used to define the proxy destination, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a valid certificate for a different hostname.

CVSS v3 Severity:

5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): None Integrity (I): Low Availibility (A): None

CVSS v2 Severity:

5.8 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:N)
4.3 Medium (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:N/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Authentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): Partial Availibility (A): None

4.3 Medium (CCN CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
3.2 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Athentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): Partial Availibility (A): None

5.8 Medium (REDHAT CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:N)
4.3 Medium (REDHAT Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:N/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Authentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): Partial Availibility (A): None

Vulnerability Type:

CWE-20

Vulnerability Consequences:

Other

References:

Source: MITRE
Type: CNA
CVE-2011-4318

Source: CONFIRM
Type: UNKNOWN
http://hg.dovecot.org/dovecot-2.0/rev/5e9eaf63a6b1

Source: REDHAT
Type: Vendor Advisory
RHSA-2013:0520

Source: CCN
Type: SA46886
Dovecot Common Name Verification Security Issue

Source: SECUNIA
Type: UNKNOWN
46886

Source: SECUNIA
Type: Vendor Advisory
52311

Source: CCN
Type: Dovecot Web Site
Dovecot v2.0.16 released

Source: MLIST
Type: UNKNOWN
[dovecot-news] 20111117 v2.0.16 released

Source: MLIST
Type: UNKNOWN
[oss-security] 20111118 Re: CVE Request -- Dovecot -- Validate certificate's CN against requested remote server hostname when proxying

Source: MLIST
Type: UNKNOWN
[oss-security] 20111118 Re: CVE Request -- Dovecot -- Validate certificate's CN against requested remote server hostname when proxying

Source: CCN
Type: BID-50709
Dovecot SSL Certificate 'Common Name' Field Validation Security Bypass Vulnerability

Source: MISC
Type: UNKNOWN
https://bugs.gentoo.org/show_bug.cgi?id=390887

Source: MISC
Type: UNKNOWN
https://bugzilla.redhat.com/show_bug.cgi?id=754980

Source: XF
Type: UNKNOWN
dovecot-commonname-weak-security(71354)

Vulnerable Configuration:

Configuration 1:

cpe:/a:dovecot:dovecot:2.0.0:-:*:*:*:*:*:*

OR cpe:/a:dovecot:dovecot:2.0.1:*:*:*:*:*:*:*

OR cpe:/a:dovecot:dovecot:2.0.2:*:*:*:*:*:*:*

OR cpe:/a:dovecot:dovecot:2.0.3:*:*:*:*:*:*:*

OR cpe:/a:dovecot:dovecot:2.0.4:*:*:*:*:*:*:*

OR cpe:/a:dovecot:dovecot:2.0.5:*:*:*:*:*:*:*

OR cpe:/a:dovecot:dovecot:2.0.6:*:*:*:*:*:*:*

OR cpe:/a:dovecot:dovecot:2.0.7:*:*:*:*:*:*:*

OR cpe:/a:dovecot:dovecot:2.0.8:*:*:*:*:*:*:*

OR cpe:/a:dovecot:dovecot:2.0.9:*:*:*:*:*:*:*

OR cpe:/a:dovecot:dovecot:2.0.10:*:*:*:*:*:*:*

OR cpe:/a:dovecot:dovecot:2.0.11:*:*:*:*:*:*:*

OR cpe:/a:dovecot:dovecot:2.0.12:*:*:*:*:*:*:*

OR cpe:/a:dovecot:dovecot:2.0.13:*:*:*:*:*:*:*

OR cpe:/a:dovecot:dovecot:2.0.14:*:*:*:*:*:*:*

OR cpe:/a:dovecot:dovecot:2.0.15:*:*:*:*:*:*:*

Configuration RedHat 1:

cpe:/o:redhat:enterprise_linux:6:*:*:*:*:*:*:*

Configuration RedHat 2:

cpe:/o:redhat:enterprise_linux:6::server:*:*:*:*:*

Configuration RedHat 3:

cpe:/o:redhat:enterprise_linux:6::workstation:*:*:*:*:*

Configuration CCN 1:

cpe:/a:dovecot:dovecot:1.2.7:*:*:*:*:*:*:*

OR cpe:/a:dovecot:dovecot:1.2.8:*:*:*:*:*:*:*

OR cpe:/a:dovecot:dovecot:1.2.11:*:*:*:*:*:*:*

OR cpe:/a:dovecot:dovecot:1.2.12:*:*:*:*:*:*:*

OR cpe:/a:dovecot:dovecot:1.2.13:*:*:*:*:*:*:*

OR cpe:/a:dovecot:dovecot:1.2.14:*:*:*:*:*:*:*

OR cpe:/a:dovecot:dovecot:2.0:beta1:*:*:*:*:*:*