Mutt vulnerability

2011-09-2900:00:00

ubuntu.com

CVSS2

5.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:P/A:N

AI Score

6.1

Confidence

Low

EPSS

0.003

Percentile

66.2%

JSON

Releases

Ubuntu 11.04
Ubuntu 10.10
Ubuntu 10.04

Packages

mutt - text-based mailreader supporting MIME, GPG, PGP and threading

Details

It was discovered that mutt incorrectly verified the hostname in an SSL
certificate. An attacker could trick mutt into trusting a rogue SMTPS,
IMAPS, or POP3S server’s certificate, which was signed by a trusted certificate
authority, to perform a machine-in-the-middle attack.

OSVersionArchitecturePackageVersionFilename
Ubuntu11.04noarchmutt< 1.5.21-2ubuntu3.1UNKNOWN
Ubuntu11.04noarchmutt-dbg< 1.5.21-2ubuntu3.1UNKNOWN
Ubuntu11.04noarchmutt-patched< 1.5.21-2ubuntu3.1UNKNOWN
Ubuntu10.10noarchmutt< 1.5.20-9ubuntu2.1UNKNOWN
Ubuntu10.10noarchmutt-dbg< 1.5.20-9ubuntu2.1UNKNOWN
Ubuntu10.10noarchmutt-patched< 1.5.20-9ubuntu2.1UNKNOWN
Ubuntu10.04noarchmutt< 1.5.20-7ubuntu1.1UNKNOWN
Ubuntu10.04noarchmutt-dbg< 1.5.20-7ubuntu1.1UNKNOWN
Ubuntu10.04noarchmutt-patched< 1.5.20-7ubuntu1.1UNKNOWN

OS	Version	Architecture	Package	Version	Filename
Ubuntu	11.04	noarch	mutt	< 1.5.21-2ubuntu3.1	UNKNOWN
Ubuntu	11.04	noarch	mutt-dbg	< 1.5.21-2ubuntu3.1	UNKNOWN
Ubuntu	11.04	noarch	mutt-patched	< 1.5.21-2ubuntu3.1	UNKNOWN
Ubuntu	10.10	noarch	mutt	< 1.5.20-9ubuntu2.1	UNKNOWN
Ubuntu	10.10	noarch	mutt-dbg	< 1.5.20-9ubuntu2.1	UNKNOWN
Ubuntu	10.10	noarch	mutt-patched	< 1.5.20-9ubuntu2.1	UNKNOWN
Ubuntu	10.04	noarch	mutt	< 1.5.20-7ubuntu1.1	UNKNOWN
Ubuntu	10.04	noarch	mutt-dbg	< 1.5.20-7ubuntu1.1	UNKNOWN
Ubuntu	10.04	noarch	mutt-patched	< 1.5.20-7ubuntu1.1	UNKNOWN