STARTTLS implementations in email clients & servers plagued by 40+ vulnerabilities

A group of German academics said they discovered more than 40 security flaws in the implementation of the STARTTLS feature in today's most popular email clients and email servers.

Also known as Opportunistic TLS, STARTTLS refers to a set of protocol extensions used by email clients and servers to upgrade older email protocols like POP3, IMAP, and SMTP from sending data via a plaintext connection to a secure TLS-encrypted channel.

Developed in the late 90s, STARTTLS worked by checking if a connection could be set up via TLS and then negotiating the TLS connection with all involved parties before sending the email data.

Although the entire STARTTLS negotiation process was fragile and prone to errors, STARTTLS came at a time when there was no broad support for encrypted connections in email clients and email servers. Lacking better alternatives at the time, most users and servers admins chose to enable STARTTLS as a temporary solution until TLS support got broader adoption across the internet.

Today, things have changed. Almost all major email clients and email servers support a pure TLS-only mode where all old protocols like POP3, IMAP, and SMTP are funneled by default via an encrypted channel that safeguards email communications from tampering or wiretapping, with email clients refusing to send emails if a secure TLS connection can't be established.

However, there are still millions of email clients and hundreds of thousands of email servers where STARTTLS is supported and still enabled.

Users advised to move from STARTTLS to TLS-only modes

In a research project presented at the USENIX 2021 security conference last week, academics said they found more than 40 vulnerabilities in STARTTLS client and server implementations that could be abused to downgrade STARTTLS connections to plaintext forms, intercept email communications, steal passwords, or tamper with email inboxes.

While these attacks required a MitM (Man/Meddler-in-the-Middle) position in order to interact with the STARTTLS initial negotiation process, the research team said that "these vulnerabilities are so common that we recommend to avoid using STARTTLS when possible" and that users and administrators should move to update their clients and servers to using TLS-only connections as soon as possible.

The good news is that the researchers have spent the past few months working with email client and server vendors to patch the 40+ vulnerabilities they discovered.

While users have the option to apply these patches and continue using STARTTLS to be safe from attacks, researchers advise that users update their client and server settings and set TLS-only as the default email communication security setting by default, something that other security experts have also been recommending since 2014 already.

Below is a summary of the issues discovered by the research team and the affected email clients and email servers.

Summary of STARTTLS client vulnerabilities

Response Injection (Buffering)

Negotiation and Tampering bugs

Avoiding Encryption via IMAP PREAUTH

Certificate Validation

Crashes

Miscellaneous

Summary of STARTTLS server vulnerabilities

Command Injection (Buffering)

Session Fixation

Miscellaneous Issues