Rapid7 Vulnerability & Exploit Database

FreeBSD: Python -- smtplib StartTLS stripping vulnerability (CVE-2016-0772)

Free InsightVM Trial No Credit Card Necessary
Watch Demo See how it all works
Back to Search

FreeBSD: Python -- smtplib StartTLS stripping vulnerability (CVE-2016-0772)

Severity
4
CVSS
(AV:N/AC:M/Au:N/C:P/I:P/A:N)
Published
06/14/2016
Created
07/25/2018
Added
07/04/2016
Modified
10/30/2017

Description

Red Hat reports: A vulnerability in smtplib allowing MITM attacker to perform a startTLS stripping attack. smtplib does not seem to raise an exception when the remote end (smtp server) is capable of negotiating starttls but fails to respond with 220 (ok) to an explicit call of SMTP.starttls(). This may allow a malicious MITM to perform a startTLS stripping attack if the client code does not explicitly check the response code for startTLS.

Solution(s)

  • freebsd-upgrade-package-python27
  • freebsd-upgrade-package-python33
  • freebsd-upgrade-package-python34
  • freebsd-upgrade-package-python35

References

insightVM

Advanced vulnerability management analytics and reporting.
Key Features
Free InsightVM Trial View All Features

With Rapid7 live dashboards, I have a clear view of all the assets on my network, which ones can be exploited, and what I need to do in order to reduce the risk in my environment in real-time. No other tool gives us that kind of value and insight.

– Scott Cheney, Manager of Information Security, Sierra View Medical Center

;