Date: Wed, 10 Mar 2010 17:01:04 +0100 From: Ludwig Nussel <ludwig.nussel@...e.de> To: oss-security@...ts.openwall.com Cc: Brian Stafford <brian@...fford.uklinux.net>, libesmtp@...fford.uklinux.net, security@...ntu.com Subject: Re: CVE Request: libesmtp does not check NULL bytes in commonName Jan Lieskovsky wrote: > From what I can tell, two should be enough: > a, libESMTP doesn't properly handle NULL character in Common Name I've created the attached patch to fix that problem > b, libESMTP's match_component() accepts two strings as equal > if they start equal but don't have equal length => cert forgery The attached patch includes the patch from Debian. However, the match_domain() function probably should be rewritten anyways I guess. It matches patters such as 'foo.bar.*' which is rather weird. libESMTP also uses the Common Name as fallback even if a dNSName in subjectAltName is present but doesn't match. The Common Name should be ignored in that case according to RFC2818. The code to perform the checks is quite complicated with openSSL and I'm not an expert so I'd be glad if someone could review the patch. This really belongs into a library ... cu Ludwig -- (o_ Ludwig Nussel //\ V_/_ http://www.suse.de/ SUSE LINUX Products GmbH, GF: Markus Rex, HRB 16746 (AG Nuernberg) View attachment "libesmtp-1.0.4-ssl.diff" of type "text/x-patch" (4547 bytes)
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.