Windows Phone Certificate Validation Vulnerability

A vulnerability has been identified in Windows Phone 7,  a remote user can spoof secure e-mail servers in certain cases.

The software does not validate Common Name (CN) values of mail server SSL certificates when sending or retrieving email via POP3, IMAP, and SMTP.

A remote user with the ability to conduct a man-in-the-middle attack between the target e-mail server and the target phone device can spoof the secure e-mail server to access the encrypted session.

NOTE: No official solution is currently available