Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 10 Mar 2010 17:01:04 +0100
From: Ludwig Nussel <>
Cc: Brian Stafford <>,,
Subject: Re: CVE Request: libesmtp does not check NULL bytes in commonName

Jan Lieskovsky wrote:
>    From what I can tell, two should be enough:
>    a, libESMTP doesn't properly handle NULL character in Common Name

I've created the attached patch to fix that problem

>    b, libESMTP's match_component() accepts two strings as equal
>       if they start equal but don't have equal length => cert forgery

The attached patch includes the patch from Debian. However, the
match_domain() function probably should be rewritten anyways I
guess. It matches patters such as '*' which is rather weird.

libESMTP also uses the Common Name as fallback even if a dNSName in
subjectAltName is present but doesn't match. The Common Name should
be ignored in that case according to RFC2818.

The code to perform the checks is quite complicated with openSSL
and I'm not an expert so I'd be glad if someone could review the
patch. This really belongs into a library ...


 (o_   Ludwig Nussel
SUSE LINUX Products GmbH, GF: Markus Rex, HRB 16746 (AG Nuernberg)

View attachment "libesmtp-1.0.4-ssl.diff" of type "text/x-patch" (4547 bytes)

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.