[Uta] Fwd: [oss-security] Requesting a CVE id for Trojitá, an e-mail client: SSL stripping

[Daniel Kahn Gillmor <[e-mail]>]

The message below was just sent to the oss-security list.  It describes
a protocol problem with the interaction between IMAP's PREAUTH mechanism
and STARTTLS mechanism.

The catch is in the intersection of two definitions:

STARTTLS is defined as a command for IMAP's "Not Authenticated" state:

 https://tools.ietf.org/html/rfc3501#section-6.2.1

But an IMAP server can also start its communications with a "PREAUTH"
response, which suggests that the client should be in the
"Authenticated" state to begin with:

 https://tools.ietf.org/html/rfc3501#section-7.1.4

So if a client is configured to use STARTTLS, and it connects to an IMAP
server on port 143, and that server (which could be an MITM) answers
with "PREAUTH", the client might not even try to issue STARTTLS (indeed,
the spec might not even allow it).

further discussion here:

 http://thread.gmane.org/gmane.mail.imap.general/3427

note that IMAP-inside-TLS isn't vulnerable to this confusing situation.

	--dkg

--- Begin Message ---

Hi folks, I would appreciate a Cc on responses as I'm not subscribed to 
this list. I would like to request a CVE for the following vulnerability:

Summary
-------

An SSL stripping vulnerability was discovered in Trojitá [1], a fast Qt 
IMAP e-mail client. *User's credentials are never leaked*, but if a user 
tries to send an e-mail, the automatic saving into the "sent" or "draft" 
folders could happen over a plaintext connection even if the user's 
preferences specify STARTTLS as a requirement.

Background
----------

The IMAP protocol defines the STARTTLS command which is used to 
transparently upgrade a plaintext connection to an encrypted one using 
SSL/TLS. The STARTTLS command can only be issued in an unauthenticated 
state as per the IMAP's state machine.

RFC 3501 also allows for a possibility of the connection jumping 
immediately into an authenticated state via the PREAUTH initial response. 
However, as the STARTTLS command cannot be issued once in the authenticated 
state, an attacker able to intercept and modify the network communication 
might trick the client into a state where the connection cannot be 
encrypted anymore.

Affected versions
-----------------

All versions of Trojitá up to 0.4 are vulnerable.

The fix will be included in version 0.4.1 (to be released after the CVE 
gets assigned).

Remedies
--------

Configurations which use the SSL/TLS form the very beginning (e.g. the 
connections using port 993) are secure and not vulnerable.

Possible impact
---------------

The user's credentials will *never* be transmitted over a plaintext 
connection even in presence of this attack.

Because Trojitá proceeded to use the connection without STARTTLS in face of 
PREAUTH, certain data might be leaked to the attacker. The only example 
which we were able to identify is the full content of a message which the 
user attempts to save to their "Sent" folder while trying to send a mail.

We don't believe that any other data could be leaked. Again, user's 
credentials will *not* be leaked as they are never transmitted under this 
scenario.

Acknowledgement
---------------

Thanks to Arnt Gulbrandsen on the imap-protocol ML for asking what happens 
when we're configured to request STARTTLS and a PREAUTH is received, and to 
Michael M Slusarz for starting that discussion.

[1] http://trojita.flaska.net/

With kind regards,
Jan

-- 
Trojitá, a fast Qt IMAP e-mail client -- http://trojita.flaska.net/

--- End Message ---