Executive Summary

Informations
Name MDVSA-2012:048 First vendor Publication 2012-04-02
Vendor Mandriva Last vendor Modification 2012-04-02
Severity (Vendor) N/A Revision N/A

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:M/Au:N/C:P/I:P/A:P)
Cvss Base Score 6.8 Attack Range Network
Cvss Impact Score 6.4 Attack Complexity Medium
Cvss Expoit Score 8.6 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

A vulnerability has been found and corrected in mutt:

Mutt does not verify that the smtps server hostname matches the domain name of the subject of an X.509 certificate, which allows man-in-the-middle attackers to spoof an SSL SMTP server via an arbitrary certificate, a different vulnerability than CVE-2009-3766 (CVE-2011-1429).

The updated packages have been patched to correct this issue.

Original Source

Url : http://www.mandriva.com/security/advisories?name=MDVSA-2012:048

CWE : Common Weakness Enumeration

% Id Name
50 % CWE-310 Cryptographic Issues
50 % CWE-20 Improper Input Validation

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:21055
 
Oval ID: oval:org.mitre.oval:def:21055
Title: USN-1221-1 -- mutt vulnerability
Description: An attacker could trick mutt into trusting a rogue server.
Family: unix Class: patch
Reference(s): USN-1221-1
CVE-2011-1429
 Version: 5
Platform(s): Ubuntu 11.04
Ubuntu 10.10
Ubuntu 10.04
 Product(s): mutt
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:22052
 
Oval ID: oval:org.mitre.oval:def:22052
Title: RHSA-2011:0959: mutt security update (Moderate)
Description: Mutt does not verify that the smtps server hostname matches the domain name of the subject of an X.509 certificate, which allows man-in-the-middle attackers to spoof an SSL SMTP server via an arbitrary certificate, a different vulnerability than CVE-2009-3766.
Family: unix Class: patch
Reference(s): RHSA-2011:0959-01
CVE-2011-1429
 Version: 4
Platform(s): Red Hat Enterprise Linux 6
 Product(s): mutt
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:23614
 
Oval ID: oval:org.mitre.oval:def:23614
Title: ELSA-2011:0959: mutt security update (Moderate)
Description: Mutt does not verify that the smtps server hostname matches the domain name of the subject of an X.509 certificate, which allows man-in-the-middle attackers to spoof an SSL SMTP server via an arbitrary certificate, a different vulnerability than CVE-2009-3766.
Family: unix Class: patch
Reference(s): ELSA-2011:0959-01
CVE-2011-1429
 Version: 6
Platform(s): Oracle Linux 6
 Product(s): mutt
Definition Synopsis:
Definition Id: oval:org.mitre.oval:def:28057
 
Oval ID: oval:org.mitre.oval:def:28057
Title: DEPRECATED: ELSA-2011-0959 -- mutt security update (moderate)
Description: [1.5.20-2.20091214hg736b6a.el6_1.1] - Fixed hostname verification of x.509 certificates. Resolves: #716889 (CVE-2011-1429)
Family: unix Class: patch
Reference(s): ELSA-2011-0959
CVE-2011-1429
 Version: 4
Platform(s): Oracle Linux 6
 Product(s): mutt
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 41

OpenVAS Exploits

Date Description
2012-08-03 Name : Mandriva Update for mutt MDVSA-2012:048 (mutt)
File : nvt/gb_mandriva_MDVSA_2012_048.nasl
2012-06-06 Name : RedHat Update for mutt RHSA-2011:0959-01
File : nvt/gb_RHSA-2011_0959-01_mutt.nasl
2012-04-30 Name : FreeBSD Ports: mutt-devel
File : nvt/freebsd_mutt-devel.nasl
2011-09-30 Name : Ubuntu Update for mutt USN-1221-1
File : nvt/gb_ubuntu_USN_1221_1.nasl
2011-07-12 Name : Fedora Update for mutt FEDORA-2011-7739
File : nvt/gb_fedora_2011_7739_mutt_fc15.nasl
2011-06-20 Name : Fedora Update for mutt FEDORA-2011-7751
File : nvt/gb_fedora_2011_7751_mutt_fc14.nasl
2011-06-20 Name : Fedora Update for mutt FEDORA-2011-7756
File : nvt/gb_fedora_2011_7756_mutt_fc13.nasl

Open Source Vulnerability Database (OSVDB)

Id Description
73731 Mutt SMTP X.509 Certificate Common Name Field MiTM Weakness
59269 Mutt mutt_ssl.c Certificate Authority (CA) Common Name Domain Name Verificati...

Nessus® Vulnerability Scanner

Date Description
2013-07-12 Name : The remote Oracle Linux host is missing a security update.
File : oraclelinux_ELSA-2011-0959.nasl - Type : ACT_GATHER_INFO
2012-08-01 Name : The remote Scientific Linux host is missing one or more security updates.
File : sl_20110719_mutt_on_SL6_x.nasl - Type : ACT_GATHER_INFO
2012-04-09 Name : The remote FreeBSD host is missing a security-related update.
File : freebsd_pkg_493143217fd411e19582001b2134ef46.nasl - Type : ACT_GATHER_INFO
2012-04-03 Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2012-048.nasl - Type : ACT_GATHER_INFO
2011-09-30 Name : The remote Ubuntu host is missing one or more security-related patches.
File : ubuntu_USN-1221-1.nasl - Type : ACT_GATHER_INFO
2011-07-20 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2011-0959.nasl - Type : ACT_GATHER_INFO
2011-06-16 Name : The remote Fedora host is missing a security update.
File : fedora_2011-7756.nasl - Type : ACT_GATHER_INFO
2011-06-12 Name : The remote Fedora host is missing a security update.
File : fedora_2011-7739.nasl - Type : ACT_GATHER_INFO
2011-06-12 Name : The remote Fedora host is missing a security update.
File : fedora_2011-7751.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.
0
Date Informations
2014-02-17 11:42:49
  • Multiple Updates