| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-Id: <E1P2rNF-0007Zf-I9@titan.mandriva.com>
Date: Mon, 04 Oct 2010 22:11:01 +0200
From: security@...driva.com
To: full-disclosure@...ts.grok.org.uk
Subject: [ MDVSA-2010:195 ] libesmtp
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
_______________________________________________________________________
Mandriva Linux Security Advisory MDVSA-2010:195
http://www.mandriva.com/security/
_______________________________________________________________________
Package : libesmtp
Date : October 4, 2010
Affected: 2008.0, 2009.0, 2009.1, 2010.0, 2010.1, Corporate 4.0,
Enterprise Server 5.0
_______________________________________________________________________
Problem Description:
Multiple vulnerabilities has been found and corrected in libesmtp:
libESMTP, probably 1.0.4 and earlier, does not properly handle a \'\0\'
(NUL) character in a domain name in the subject's Common Name (CN)
field of an X.509 certificate, which allows man-in-the-middle attackers
to spoof arbitrary SSL servers via a crafted certificate issued by a
legitimate Certification Authority, a related issue to CVE-2009-2408
(CVE-2010-1192).
The match_component function in smtp-tls.c in libESMTP 1.0.3.r1, and
possibly other versions including 1.0.4, treats two strings as equal if
one is a substring of the other, which allows remote attackers to spoof
trusted certificates via a crafted subjectAltName (CVE-2010-1194).
Packages for 2008.0 and 2009.0 are provided as of the Extended
Maintenance Program. Please visit this link to learn more:
http://store.mandriva.com/product_info.php?cPath=149&products_id=490
The updated packages have been patched to correct these issues.
_______________________________________________________________________
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1192
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1194
_______________________________________________________________________
Updated Packages:
Mandriva Linux 2008.0:
d5d325c2a9394b23714c60c230146162 2008.0/i586/libesmtp5-1.0.4-1.1mdv2008.0.i586.rpm
01e2b2aee7b00bb2c1c63628750ce61a 2008.0/i586/libesmtp5-devel-1.0.4-1.1mdv2008.0.i586.rpm
66721fe590c7b76c26b7f167d3b8d4a4 2008.0/SRPMS/libesmtp-1.0.4-1.1mdv2008.0.src.rpm
Mandriva Linux 2008.0/X86_64:
7f9003c599ceef90b25d7f0582515a66 2008.0/x86_64/lib64esmtp5-1.0.4-1.1mdv2008.0.x86_64.rpm
530085f77adcd0dec9e3fb154b0c8c2b 2008.0/x86_64/lib64esmtp5-devel-1.0.4-1.1mdv2008.0.x86_64.rpm
66721fe590c7b76c26b7f167d3b8d4a4 2008.0/SRPMS/libesmtp-1.0.4-1.1mdv2008.0.src.rpm
Mandriva Linux 2009.0:
43e4795d0259c57eefd34d9662b1182d 2009.0/i586/libesmtp5-1.0.4-4.1mdv2009.0.i586.rpm
f1436a52a7ffcc8f38b2d6617e8324eb 2009.0/i586/libesmtp-devel-1.0.4-4.1mdv2009.0.i586.rpm
2405545e5e3e9cf3a60b0edbbafc61b9 2009.0/SRPMS/libesmtp-1.0.4-4.1mdv2009.0.src.rpm
Mandriva Linux 2009.0/X86_64:
85583d41d8b45be05d893af5756ec8d2 2009.0/x86_64/lib64esmtp5-1.0.4-4.1mdv2009.0.x86_64.rpm
2c9cfdf87cd3d1e91792d7e9d4dbdc80 2009.0/x86_64/lib64esmtp-devel-1.0.4-4.1mdv2009.0.x86_64.rpm
2405545e5e3e9cf3a60b0edbbafc61b9 2009.0/SRPMS/libesmtp-1.0.4-4.1mdv2009.0.src.rpm
Mandriva Linux 2009.1:
fbbae5b5574e8e014253cb5d1f5cfca0 2009.1/i586/libesmtp5-1.0.4-5.1mdv2009.1.i586.rpm
6e08c2b25ea7200bba7a22e2ba7e2bfa 2009.1/i586/libesmtp-devel-1.0.4-5.1mdv2009.1.i586.rpm
f2d40725974760c629e0bb296176f1ec 2009.1/SRPMS/libesmtp-1.0.4-5.1mdv2009.1.src.rpm
Mandriva Linux 2009.1/X86_64:
ee3ff7a9b146f55eccaaefeb966eb473 2009.1/x86_64/lib64esmtp5-1.0.4-5.1mdv2009.1.x86_64.rpm
fd3300fcc6a99b084b5fc5cb69478feb 2009.1/x86_64/lib64esmtp-devel-1.0.4-5.1mdv2009.1.x86_64.rpm
f2d40725974760c629e0bb296176f1ec 2009.1/SRPMS/libesmtp-1.0.4-5.1mdv2009.1.src.rpm
Mandriva Linux 2010.0:
4e992cfb253ac51c72ff420d2862fe35 2010.0/i586/libesmtp5-1.0.4-6.1mdv2010.0.i586.rpm
fdccc3a0c98049bb236eeecd7869e666 2010.0/i586/libesmtp-devel-1.0.4-6.1mdv2010.0.i586.rpm
5047b7270f09adffaf5202df4ec4e2cd 2010.0/SRPMS/libesmtp-1.0.4-6.1mdv2010.0.src.rpm
Mandriva Linux 2010.0/X86_64:
e3dc2c0ced2c25f3ac5ae63931a7f67e 2010.0/x86_64/lib64esmtp5-1.0.4-6.1mdv2010.0.x86_64.rpm
4e1ac4edd11f17dc1e3607be87984077 2010.0/x86_64/lib64esmtp-devel-1.0.4-6.1mdv2010.0.x86_64.rpm
5047b7270f09adffaf5202df4ec4e2cd 2010.0/SRPMS/libesmtp-1.0.4-6.1mdv2010.0.src.rpm
Mandriva Linux 2010.1:
5499b0406f43651b5fffd6b5223c0d38 2010.1/i586/libesmtp5-1.0.4-8.1mdv2010.1.i586.rpm
169b22760527862bf65d074179112ac3 2010.1/i586/libesmtp-devel-1.0.4-8.1mdv2010.1.i586.rpm
06903188f0a5201dd2288cc1126a499f 2010.1/SRPMS/libesmtp-1.0.4-8.1mdv2010.1.src.rpm
Mandriva Linux 2010.1/X86_64:
da58a753b506123906c752350ee79168 2010.1/x86_64/lib64esmtp5-1.0.4-8.1mdv2010.1.x86_64.rpm
b9b453aecbaa9740e5b2aaf0538975e5 2010.1/x86_64/lib64esmtp-devel-1.0.4-8.1mdv2010.1.x86_64.rpm
06903188f0a5201dd2288cc1126a499f 2010.1/SRPMS/libesmtp-1.0.4-8.1mdv2010.1.src.rpm
Corporate 4.0:
7b2868bc2a7a58d921126c333c6862b1 corporate/4.0/i586/libesmtp5-1.0.4-0.1.20060mlcs4.i586.rpm
febd67c3c2c68d8798c17cadfc3c79a8 corporate/4.0/i586/libesmtp5-devel-1.0.4-0.1.20060mlcs4.i586.rpm
f2dbeb8bec24531e717b72608b8d5659 corporate/4.0/SRPMS/libesmtp-1.0.4-0.1.20060mlcs4.src.rpm
Corporate 4.0/X86_64:
b0f3670dc01c62ea4f100ad41c4d9fc3 corporate/4.0/x86_64/lib64esmtp5-1.0.4-0.1.20060mlcs4.x86_64.rpm
065c29c3aa0a708c11602bf7ef029782 corporate/4.0/x86_64/lib64esmtp5-devel-1.0.4-0.1.20060mlcs4.x86_64.rpm
f2dbeb8bec24531e717b72608b8d5659 corporate/4.0/SRPMS/libesmtp-1.0.4-0.1.20060mlcs4.src.rpm
Mandriva Enterprise Server 5:
700aaa77ad5f282e2df2049bd7132fe2 mes5/i586/libesmtp5-1.0.4-4.1mdvmes5.1.i586.rpm
71c70f199708b4e5e9a91dae8e2d680d mes5/i586/libesmtp-devel-1.0.4-4.1mdvmes5.1.i586.rpm
102df9e6ed4321d9580911c5806be92f mes5/SRPMS/libesmtp-1.0.4-4.1mdvmes5.1.src.rpm
Mandriva Enterprise Server 5/X86_64:
403dbe77fd8e01c679ed8113f31068f6 mes5/x86_64/lib64esmtp5-1.0.4-4.1mdvmes5.1.x86_64.rpm
3a55f65b981f961081dc5087fc9ca365 mes5/x86_64/lib64esmtp-devel-1.0.4-4.1mdvmes5.1.x86_64.rpm
102df9e6ed4321d9580911c5806be92f mes5/SRPMS/libesmtp-1.0.4-4.1mdvmes5.1.src.rpm
_______________________________________________________________________
To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.
All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:
gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandriva Linux at:
http://www.mandriva.com/security/advisories
If you want to report vulnerabilities, please contact
security_(at)_mandriva.com
_______________________________________________________________________
Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
iD8DBQFMqgIUmqjQ0CJFipgRAmO1AJ9fqHxQIlI79RjLKU8EF6MhZpActgCfYp1R
JQNl8vzOizgg7PXXnfrbOms=
=MxHz
-----END PGP SIGNATURE-----
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
Powered by blists - more mailing lists