[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 10 Mar 2010 17:01:04 +0100
From: Ludwig Nussel <ludwig.nussel@...e.de>
To: oss-security@...ts.openwall.com
Cc: Brian Stafford <brian@...fford.uklinux.net>,
libesmtp@...fford.uklinux.net, security@...ntu.com
Subject: Re: CVE Request: libesmtp does not check NULL bytes in commonName
Jan Lieskovsky wrote:
> From what I can tell, two should be enough:
> a, libESMTP doesn't properly handle NULL character in Common Name
I've created the attached patch to fix that problem
> b, libESMTP's match_component() accepts two strings as equal
> if they start equal but don't have equal length => cert forgery
The attached patch includes the patch from Debian. However, the
match_domain() function probably should be rewritten anyways I
guess. It matches patters such as 'foo.bar.*' which is rather weird.
libESMTP also uses the Common Name as fallback even if a dNSName in
subjectAltName is present but doesn't match. The Common Name should
be ignored in that case according to RFC2818.
The code to perform the checks is quite complicated with openSSL
and I'm not an expert so I'd be glad if someone could review the
patch. This really belongs into a library ...
cu
Ludwig
--
(o_ Ludwig Nussel
//\
V_/_ http://www.suse.de/
SUSE LINUX Products GmbH, GF: Markus Rex, HRB 16746 (AG Nuernberg)
View attachment "libesmtp-1.0.4-ssl.diff" of type "text/x-patch" (4547 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
