Mutt does not verify that the smtps server hostname matches...

Vulnerability Description

Mutt does not verify that the smtps server hostname matches the domain name of the subject of an X.509 certificate, which allows man-in-the-middle attackers to spoof an SSL SMTP server via an arbitrary certificate, a different vulnerability than CVE-2009-3766.

References

• http://www.redhat.com/support/errata/RHSA-2011-0959.html
• http://secunia.com/advisories/44937
• http://securityreason.com/securityalert/8143
• https://exchange.xforce.ibmcloud.com/vulnerabilities/66015
• http://seclists.org/fulldisclosure/2011/Mar/87
• http://lists.fedoraproject.org/pipermail/package-announce/2011-June/061356.html
• http://lists.fedoraproject.org/pipermail/package-announce/2011-June/061353.html
• http://lists.fedoraproject.org/pipermail/package-announce/2011-June/061461.html
• http://www.securityfocus.com/bid/46803