New User, Welcome! Login

Re: iphone email client does not validate ssl certificates

From:	Pavel Machek <pavel ucw cz>
To:	Bill Borskey <wborskey gmail com>
Cc:	bugtraq securityfocus com
Subject:	Re: iphone email client does not validate ssl certificates
Date:	Sat - Sep 26, 2009 02:08 AM

Hi!

> iPod/iPhone standard e-mail application does not validate SSL certificates
> and is vulnerable to a MITM (man in the middle attack).
> 
> Vulnerable: All versions.

Well... mujmail.org email client also does not validate ssl
cerificates -- optionaly. Reasoning is that SSL with unverified
certificate is still better than sending plaintext passwords.

Does that count as a vulnerability?
                                                                Pavel

-- 
(english) http://www.livejournal.com/~pavelmachek
(cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html

Nearly all of LinuxRocket's features are free. Be kind and donate to the cause!