[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 11 Mar 2010 14:58:02 +0000
From: Brian Stafford <brian@...fford.uklinux.net>
To: Ludwig Nussel <ludwig.nussel@...e.de>
Cc: oss-security@...ts.openwall.com, libesmtp@...fford.uklinux.net,
security@...ntu.com
Subject: Re: CVE Request: libesmtp does not check NULL bytes
in commonName
Ludwig Nussel wrote:
> Brian Stafford wrote:
>
>> Ludwig Nussel wrote:
>>
>>> The attached patch includes the patch from Debian. However, the
>>> match_domain() function probably should be rewritten anyways I
>>> guess. It matches patters such as 'foo.bar.*' which is rather weird.
>>>
>> [...]
>> RFC 2818 does not constrain which domain name components may contain
>> wildcards. Names such as *.bar.com, foo.*.com and foo.bar.* are
>> therefore all valid despite the latter two cases appearing
>> unconventional. The examples from RFC 2818 show wildcards only in the
>> leading domain name components. Examples are neither normative nor
>> exhaustive and may not therefore imply constraints or extensions of a
>> standard's normative text. Comparison bugs aside, I believe that
>> libESMTP's behaviour correctly implements RFC 2818 in this respect.
>>
>
> Hmm. Yes, RFC 2818 could be interpretet that way. RFCs 2595 (IMAP),
> 4642 (NNTP) and 4513 (LDAP) restrict wildcards to the leftmost
> component. The LDAP one doesn't allow wildcards in CN's though and
> none of them explicitly disallows use of the CN if a subjAltname is
> present. RFC 3207 (SMTP) doesn't tell how matching should be
> performed. perl-IO-Socket therefore doesn't allow wildcards for
> smtp. perl-IO-Socket has the most flexible implementation I've seen
> so far but intentionally only supports one wildcard at the leftmost
> side. What a mess.
>
> cu
> Ludwig
>
>
Hmm, looking over RFC 3207 again, I'm wondering where I originally got
the inspiration to use RFC 2818 as the reference for checking domain
names in certificates. One possibility is Eric Rescorla's SSL/TLS book
(he is also the author of RFC 2818), I'll have a look there again later.
RFC 3207 states
The decision of whether or not to believe the authenticity of the
other party in a TLS negotiation is a local matter.
which is not normative language (i.e. has not been phrased with MUST,
SHOULD, REQUIRED etc) but implies that *any* policy is suitable (as long
as both communicating parties implement that policy). Worse, this means
there is no interoperable standard for validating certificates used to
secure SMTP over TLS, We cannot even make the decision that fully
flexible wildcards, leading wildcards only or no wildcards at all is the
way to go. Furthermore, we cannot even decide which fields within the
X.509 certificate are to be used.
I find myself coming back to RFC 2818 being a reasonable choice since it
is flexible and (almost) clear, and since HTTPS, as a major user of TLS,
is, I assume, well analysed for security implications wrt certificate
validation.
Is it the case that for STARTTLS in SMTP what we are really interested
in is encrypting the data on the wire and authentication is only of
secondary importance? Do we know what the best current practice is
among CAs when it comes to issuing certificates for STARTTLS?
Brian
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
