Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 16 Mar 2010 11:46:11 +0000
From: Brian Stafford <brian@...fford.uklinux.net>
To: oss-security@...ts.openwall.com
Cc: libesmtp@...fford.uklinux.net, security@...ntu.com,
	Pawel Salek <pawsa@...ochem.kth.se>, jskarvad@...hat.com
Subject: Re: CVE Request: libesmtp does not check NULL bytes
 in commonName

Ludwig Nussel wrote:
> Brian Stafford wrote:
>   
>> I think the best approach is to apply Pawel's patch as this is the 
>>     
>
> I must have missed that patch. Could you re-post it?
>   
It's available at https://bugzilla.redhat.com/attachment.cgi?id=399131
>   
>> simplest in terms of changes to the existing code base, and perhaps move 
>> to Ludwig's for a later release of libESMTP.  In the slightly longer 
>> term, I think the internet draft at
>> http://tools.ietf.org/html/draft-saintandre-tls-server-id-check is the 
>> one to follow but this might change substantially or even fall of the 
>> rails entirely.
>>
>> [...] The I-D says only the leftmost 
>> component may contain a wildcard but this would rule out *.*.google.com 
>> The algorithm I've outlined is really a halfway house between RFC2818, 
>> which I think is too flexible, and the I-D; limit the positions of 
>> wildcards in the hostname and dont allow elaborate matches within a 
>> hostname component.  Any ideas or opinions on this would be useful.
>>     
>
> Is there a way to comment on the draft? Maybe the author of the
> draft didn't think about the cases you'd like to handle.
>   
Normally IETF working groups create a mailing list for discussion of 
drafts when chartered and any interested party may subscribe.  However, 
as far as I can tell, this I-D is an individual submission;  I can't 
find a mailing list address so probably best to mail the authors directly.
> cu
> Ludwig
>
>   
Regards
Brian

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.