PT-2009-3905 · Mutt+2 · Mutt+2

Miroslav Lichvar · Published 2009-06-16 · Updated 2017-08-17 · CVE-2009-1390

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Mutt version 1.5.19

Description The issue allows remote attackers to spoof trusted servers via a man-in-the-middle attack because it only verifies one TLS certificate in the chain instead of the entire chain. This can occur when Mutt is linked against either OpenSSL or GnuTLS.

Recommendations For Mutt version 1.5.19, consider updating to a version that properly verifies the entire TLS certificate chain to prevent man-in-the-middle attacks. As a temporary workaround, restrict access to sensitive information until a patch is available.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2009-1390

Affected Products

Gnutls

Mutt

Openssl

References · 10

• 🔥 http://dev.mutt.org/hg/mutt/rev/64bf199c8d8a · Exploit
• 🔥 http://dev.mutt.org/hg/mutt/rev/8f11dd00c770 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-1390 · Security Note
• http://openwall.com/lists/oss-security/2009/06/10/2 · Patch
• https://redhat.com/archives/fedora-package-announce/2009-June/msg00715.html · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2009-1390 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2009-1390 · Vendor Advisory
• http://securityfocus.com/bid/35288 · Patch
• https://security-tracker.debian.org/tracker/CVE-2009-1390 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/51068 · Note