Test ID:	1.3.6.1.4.1.25623.1.0.840950
Category:	Ubuntu Local Security Checks
Title:	Ubuntu: Security Advisory (USN-1295-1)
Summary:	The remote host is missing an update for the 'dovecot' package(s) announced via the USN-1295-1 advisory.
Description:	Summary: The remote host is missing an update for the 'dovecot' package(s) announced via the USN-1295-1 advisory. Vulnerability Insight: It was discovered that Dovecot incorrectly validated certificate hostnames when being used as a POP3 and IMAP proxy. If a remote attacker were able to perform a machine-in-the-middle attack, this flaw could be exploited to view sensitive information. Affected Software/OS: 'dovecot' package(s) on Ubuntu 11.10. Solution: Please install the updated package(s). CVSS Score: 5.8 CVSS Vector: AV:N/AC:M/Au:N/C:P/I:P/A:N
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2011-4318 46886 http://secunia.com/advisories/46886 52311 http://secunia.com/advisories/52311 RHSA-2013:0520 http://rhn.redhat.com/errata/RHSA-2013-0520.html [dovecot-news] 20111117 v2.0.16 released http://www.dovecot.org/list/dovecot-news/2011-November/000200.html [oss-security] 20111118 Re: CVE Request -- Dovecot -- Validate certificate's CN against requested remote server hostname when proxying http://www.openwall.com/lists/oss-security/2011/11/18/5 http://www.openwall.com/lists/oss-security/2011/11/18/7 http://hg.dovecot.org/dovecot-2.0/rev/5e9eaf63a6b1 https://bugs.gentoo.org/show_bug.cgi?id=390887 https://bugzilla.redhat.com/show_bug.cgi?id=754980
Copyright	Copyright (C) 2012 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.