PT-2009-3905 · Mutt+2 · Mutt+2

Miroslav Lichvar · Publicado 2009-06-16 · Atualizado 2017-08-17 · CVE-2009-1390

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Mutt version 1.5.19

Description The issue allows remote attackers to spoof trusted servers via a man-in-the-middle attack because it only verifies one TLS certificate in the chain instead of the entire chain. This can occur when Mutt is linked against either OpenSSL or GnuTLS.

Recommendations For Mutt version 1.5.19, consider updating to a version that properly verifies the entire TLS certificate chain to prevent man-in-the-middle attacks. As a temporary workaround, restrict access to sensitive information until a patch is available.

Exploit

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2009-1390

Produtos afetados

Gnutls

Mutt

Openssl

Referências · 10

• 🔥 http://dev.mutt.org/hg/mutt/rev/64bf199c8d8a · Exploit
• 🔥 http://dev.mutt.org/hg/mutt/rev/8f11dd00c770 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-1390 · Nota de Segurança
• http://openwall.com/lists/oss-security/2009/06/10/2 · Correção
• https://redhat.com/archives/fedora-package-announce/2009-June/msg00715.html · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2009-1390 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2009-1390 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/51068 · Nota
• http://securityfocus.com/bid/35288 · Correção
• https://security-tracker.debian.org/tracker/CVE-2009-1390 · Aviso do Fabricante