CVE-2016-0772

Bypass of TLS protections in smtplib library

• CVSS 6.5
• CWE-693: Protection Mechanism Failure
• Cryptographic
• Remote

The smtplib library in CPython (aka Python) before 2.7.12, 3.x before 3.4.5, and 3.5.x before 3.5.2 does not return an error when StartTLS fails, which might allow man-in-the-middle attackers to bypass the TLS protections by leveraging a network position between the client and the registry to block the StartTLS command, aka a "StartTLS stripping attack."

CVE

CVE-2016-0772

CWE

CWE-693: Protection Mechanism Failure

CVSS base score

6.5

Published

2016-09-02

OWASP

A08 Software and Data Integrity Failures

Orthogonal defect classification

Checking

Code defect classification

Incorrect Check

Category

Cryptographic

Subcategory

Cryptographic Implementation Error

Accessibility scope

Remote

Impact

Unauthorized Access

Fixed by upgrading

Yes

Solution

Upgrade to a Python version that is 2.7.12 or higher, 3.4.5 or higher, or 3.5.2 or higher.

import smtplib

class SMTP(smtplib.SMTP):
    def starttls(self, keyfile=None, certfile=None):
        self.docmd("STARTTLS")

if __name__ == "__main__":
    smtp = SMTP('smtp.example.com', 587)
    smtp.ehlo()
    smtp.starttls()
    smtp.ehlo()
    print("TLS established (potentially vulnerable).")

import smtplib

class SMTP(smtplib.SMTP):
    def starttls(self, keyfile=None, certfile=None):
        response = self.docmd("STARTTLS")
        if response[0] != 220:
            raise RuntimeError("STARTTLS failed, potential man-in-the-middle attack detected.")
        return super().starttls(keyfile, certfile)

if __name__ == "__main__":
    try:
        smtp = SMTP('smtp.example.com', 587)
        smtp.ehlo()
        smtp.starttls()
        smtp.ehlo()
        print("TLS established successfully.")
    except RuntimeError as e:
        print("Error:", e)

@misc{vaitp:cve20160772,
  title        = {{Bypass of TLS protections in smtplib library}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2016},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2016-0772},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2016-0772/}}
}