CVE-2009-3765

Why Exploitable

The vulnerability in mutt_ssl.c allows man-in-the-middle attackers to spoof SSL servers by crafting a certificate with a '\0' character in the domain name. This issue is related to CVE-2009-2408 and affects mutt versions 1.5.19 and 1.5.20 when using OpenSSL.

Key factors affecting exploitability:

• EPSS (Empirical Exploitation Probability Score) is not available, making it difficult to assess the likelihood of exploitation.
• The absence of public exploit/PoC references and CISA KEV listing reduces the perceived urgency.
• However, organizations should still validate their mutt versions and OpenSSL configurations to ensure they are not vulnerable to this attack.

It is essential for organizations to review their SSL certificate handling and validation processes to prevent potential man-in-the-middle attacks. Although there are no public exploits available, the vulnerability can still be exploited by skilled attackers. Therefore, organizations should prioritize patching or updating their mutt versions to prevent potential security breaches.

Overview

CVE-2009-3765 is a certificate name validation flaw in Mutt's mutt_ssl.c when linked against OpenSSL. NUL in CN can truncate comparison, accepting attacker certs that match a prefix of the intended hostname.

Technical details

Related to CVE-2009-2408 class of NUL-in-CN issues. Legitimate CA-issued cert with crafted CN evil.com\\0.trusted.com may satisfy naive string compare.

Impact

Confidentiality breach of mail traffic — credentials and message content exposed to MITM on SSL/TLS mail connections.

Exploitation steps

1. Position on network path to victim Mutt client. 2. Present crafted cert during IMAPS handshake. 3. Mutt accepts due to NUL truncation. 4. Proxy mail session.

Indicators of compromise

Unexpected cert warnings absent though wrong server; MITM appliance logs; CN anomalies in captured handshakes.

Mitigation and workarounds

Upgrade Mutt past 1.5.20; use distribution backports; verify cert hostnames with modern TLS libraries.

Community reactions

2009 OpenSSL application ecosystem wake-up alongside similar NUL-CN bugs in other clients.

Additional resources

• NVD CVE-2009-3765