Test ID:	1.3.6.1.4.1.25623.1.0.71027
Category:	Ubuntu Local Security Checks
Title:	Ubuntu USN-1295-1 (dovecot-common)
Summary:	NOSUMMARY
Description:	Description: The remote host is missing an update to dovecot-common announced via advisory USN-1295-1. Details: It was discovered that Dovecot incorrectly validated certificate hostnames when being used as a POP3 and IMAP proxy. If a remote attacker were able to perform a man-in-the-middle attack, this flaw could be exploited to view sensitive information. Solution: The problem can be corrected by updating your system to the following package versions: Ubuntu 11.10: dovecot-common 1:2.0.13-1ubuntu3.2 http://www.securityspace.com/smysecure/catid.html?in=USN-1295-1
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2011-4318 46886 http://secunia.com/advisories/46886 52311 http://secunia.com/advisories/52311 RHSA-2013:0520 http://rhn.redhat.com/errata/RHSA-2013-0520.html [dovecot-news] 20111117 v2.0.16 released http://www.dovecot.org/list/dovecot-news/2011-November/000200.html [oss-security] 20111118 Re: CVE Request -- Dovecot -- Validate certificate's CN against requested remote server hostname when proxying http://www.openwall.com/lists/oss-security/2011/11/18/5 http://www.openwall.com/lists/oss-security/2011/11/18/7 http://hg.dovecot.org/dovecot-2.0/rev/5e9eaf63a6b1 https://bugs.gentoo.org/show_bug.cgi?id=390887 https://bugzilla.redhat.com/show_bug.cgi?id=754980
Copyright	Copyright (c) 2012 E-Soft Inc. http://www.securityspace.com

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.