Date: Mon, 15 Mar 2010 22:08:33 +0000 From: Brian Stafford <brian@...fford.uklinux.net> To: Ludwig Nussel <ludwig.nussel@...e.de>, oss-security@...ts.openwall.com, libesmtp@...fford.uklinux.net, security@...ntu.com, Pawel Salek <pawsa@...ochem.kth.se>, jlieskov@...hat.com, jskarvad@...hat.com Subject: Re: CVE Request: libesmtp does not check NULL bytes in commonName Hello all I think the best approach is to apply Pawel's patch as this is the simplest in terms of changes to the existing code base, and perhaps move to Ludwig's for a later release of libESMTP. In the slightly longer term, I think the internet draft at http://tools.ietf.org/html/draft-saintandre-tls-server-id-check is the one to follow but this might change substantially or even fall of the rails entirely. For the next libESMTP release I'm considering changing match_domain() as follows: for each hostname component accept either a string or a single wildcard character '*' as the pattern. In either case only characters from the set [A-Za-z0-9-] in the hostname shall be accepted, otherwise the match shall fail. If the top level domain has only two characters then wildcards are barred from the 3 topmost components, otherwise from the topmost 2 components, e.g. *.example.com is acceptable but not *.co.uk. f*.bar.com would not be acceptable. The I-D says only the leftmost component may contain a wildcard but this would rule out *.*.google.com The algorithm I've outlined is really a halfway house between RFC2818, which I think is too flexible, and the I-D; limit the positions of wildcards in the hostname and dont allow elaborate matches within a hostname component. Any ideas or opinions on this would be useful. Regards Brian
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.