Mutt: failure to check server certificate in SMTP TLS connection

[Honza Horak]

It also turns out that I didn't test this issue enough. As I didn't
test with both gnutls and openssl. I only tested with gnutls. Mutt
actually works as I would expect with imaps, smtps and smtp -- with
starttls connection when using openssl. mutt appears to be _broken_
when using gnutls for imaps, smtps and smtp -- with starttls. (on mutt 1.5.20).

Hi,

I've tested this behaviour using both - gnutls and openssl - and it
seems like the only difference is that there is an error printed using
openssl: "Certificate host check failed: certificate owner does not
match hostname imap.myhost.web".

In both cases a user can accept the certificate, but there is no warning
about certificate's hostname mishmash using gnutls, which is a
vulnerability.

I just wanted to sum up the issue, do I understand it correctly?

Honza

<javascript:void(0);>

[dave b]

Hi,
I've tested this behaviour using both - gnutls and openssl - and it seems
"Certificate host check failed: certificate owner does not match hostname
imap.myhost.web".
In both cases a user can accept the certificate, but there is no warning
about certificate's hostname mishmash using gnutls, which is a
vulnerability.
I just wanted to sum up the issue, do I understand it correctly?

Yes and no. The thing is with gnutls if the certificate is valid for
another host - like I had in my test example then gnutls will not show
the error and will continue as if there is no error.
Obviously if the host has a certificate that is not 'valid' (e.g. self
signed) mutt will
prompt and ask for you to accept it first .

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/