Jump to content

Dozens of STARTTLS Related Flaws Found Affecting Popular Email Clients


Recommended Posts


Security researchers have disclosed as many as 40 different vulnerabilities associated with an opportunistic encryption mechanism in mail clients and servers that could open the door to targeted man-in-the-middle (MitM) attacks, permitting an intruder to forge mailbox content and steal credentials.

The now-patched flaws, identified in various STARTTLS implementations, were detailed by a group of researchers Damian Poddebniak, Fabian Ising, Hanno Böck, and Sebastian Schinzel at the 30th USENIX Security Symposium. In an Internet-wide scan conducted during the study, 320,000 email servers were found vulnerable to what's called a command injection attack.

Some of the popular clients affected by the bugs include Apple Mail, Gmail, Mozilla Thunderbird, Claws Mail, Mutt, Evolution, Exim, Mail.ru, Samsung Email, Yandex, and KMail. The attacks require that the malicious party can tamper connections established between an email client and the email server of a provider and has login credentials for their own account on the same server.

Stating that implicit TLS is a more secure option than STARTTLS, the researchers recommend users to configure their email clients to use SMTP, POP3 and IMAP with implicit TLS on dedicated ports (port 465, port 995, and port 993 respectively), in addition to urging developers of email server and client applications to offer implicit TLS by default.


Edited by itman
Link to comment
Share on other sites

This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
  • Create New...