Re: CVE Request -- Dovecot -- Validate certificate's CN against requested remote server hostname when proxying

[Timo Sirainen <tss () iki fi>]

On Fri, 2011-11-18 at 14:37 +0100, Jan Lieskovsky wrote:

>    a security flaw was found in the way Dovecot, an IMAP and POP3 email
> server, performed remote server identity verification (x509
> certificate's Common Name field was not checked to match provided
> remote server host name), when Dovecot was configured to proxy IMAP and
> POP3 connections to remote hosts and TLS/SSL protocols were requested
> (ssl=yes or starttls=yes) in the configuration to secure these
> connections to the destination server. A remote attacker could use
> this flaw to conduct man-in-the-middle (MITM) attacks via specially-
> crafted x509v3 certificate.
..
> But on the other hand, this change is important enough, to be
> backported to all affected versions,

SSL proxy connections were added in some Dovecot v1.x version, but v1.x
doesn't support giving hostname as proxy destination, only IP address.
So this can't really be backported to v1.x.

My v2.0 change keeps this backwards compatible with existing setups that
use IP addresses, so that the hostname check is skipped when connecting
with IP.

Upcoming v2.1 is stricter and doesn't skip the check, which basically
means that ssl=yes with IP address as destination always fails.