Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Mon, 15 Mar 2010 22:08:33 +0000
From: Brian Stafford <>
To: Ludwig Nussel <>,,,, Pawel Salek <>,,
Subject: Re: CVE Request: libesmtp does not check NULL bytes
 in commonName

Hello all

I think the best approach is to apply Pawel's patch as this is the 
simplest in terms of changes to the existing code base, and perhaps move 
to Ludwig's for a later release of libESMTP.  In the slightly longer 
term, I think the internet draft at is the 
one to follow but this might change substantially or even fall of the 
rails entirely.

For the next libESMTP release I'm considering changing match_domain() as 
for each hostname component accept either a string or a single wildcard 
character '*' as the pattern.  In either case only characters from the 
set [A-Za-z0-9-] in the hostname shall be accepted, otherwise the match 
shall fail.  If the top level domain has only two characters then 
wildcards are barred from the 3 topmost components, otherwise from the 
topmost 2 components, e.g. * is acceptable but not *  
f* would not be acceptable.  The I-D says only the leftmost 
component may contain a wildcard but this would rule out *.* 
The algorithm I've outlined is really a halfway house between RFC2818, 
which I think is too flexible, and the I-D; limit the positions of 
wildcards in the hostname and dont allow elaborate matches within a 
hostname component.  Any ideas or opinions on this would be useful.


Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.