CVE-2011-4318: Input Validation
A security flaw was found in the way Dovecot, an IMAP and POP3 email server, performed remote server identity verification (x509 certificate's Common Name field was not checked to match provided remote server host name), when Dovecot was configured to proxy IMAP and POP3 connections to remote hosts and TLS/SSL protocols were requested (ssl=yes or starttls=yes) in the configuration to secure these connections to the destination server. A remote attacker could use this flaw to conduct man-in-the-middle (MITM) attacks via specially-crafted x509v3 certificate.
References: [1] http://www.dovecot.org/list/dovecot-news/2011-November/000200.html [2] https://secunia.com/advisories/46886/ [3] https://bugs.gentoo.org/showbug.cgi?id=390887 [4] http://wiki.dovecot.org/PasswordDatabase/ExtraFields/Proxy
Relevant upstream patch: [5] http://hg.dovecot.org/dovecot-2.0/rev/5e9eaf63a6b1
Other sources
Dovecot 2.0.x before 2.0.16, when ssl or starttls is enabled and hostname is used to define the proxy destination, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a valid certificate for a different hostname.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2011-4318?
CVE-2011-4318 is classified as a moderate severity vulnerability.
How do I fix CVE-2011-4318?
To fix CVE-2011-4318, upgrade Dovecot to version 2.0.16 or later.
What versions of Dovecot are affected by CVE-2011-4318?
CVE-2011-4318 affects Dovecot versions 2.0.0 to 2.0.15.
What is the impact of CVE-2011-4318?
The impact of CVE-2011-4318 is that it may allow man-in-the-middle attacks due to improper verification of server identities.
Is CVE-2011-4318 related to remote server connections?
Yes, CVE-2011-4318 specifically involves vulnerabilities in proxying remote IMAP and POP3 connections.