Overview
Windows Phone 7 does not check CN (Common Name) of server certificates when receiving or sending e-mails using POP3/IMAP/SMTP servers using SSL.
Description
Windows Phone 7 fails to check the CN (Common Name) of server certificates when receiving or sending e-mails using POP3/IMAP/SMTP servers using SSL allowing an attacker to perform a man-in-the-middle attack between the phone and the mail server. |
Impact
A remote attacker with the ability to pose as a man-in-the-middle may be able to view the login or session data in the corresponding protocol (e.g., SMTP, POP3, etc.). |
Solution
Microsoft has acknowledged this vulnerability and stated that they will be releasing an update. |
Vendor Information
CVSS Metrics
| Group | Score | Vector |
|---|---|---|
| Base | 5.4 | AV:N/AC:H/Au:N/C:C/I:N/A:N |
| Temporal | 4.4 | E:POC/RL:U/RC:UC |
| Environmental | 4.6 | CDP:LM/TD:M/CR:ND/IR:ND/AR:ND |
References
Acknowledgements
Thanks to the reporter that wishes to remain anonymous.
This document was written by Michael Orlando.
Other Information
| CVE IDs: | CVE-2012-2993 |
| Date Public: | 2012-09-17 |
| Date First Published: | 2012-09-17 |
| Date Last Updated: | 2012-09-17 11:58 UTC |
| Document Revision: | 11 |