Re: CVE Request: libesmtp does not check NULL bytes in commonName

[Brian Stafford <brian () stafford uklinux net>]

Ludwig Nussel wrote:
> Brian Stafford wrote:
>   
> > [...]
> > I find myself coming back to RFC 2818 being a reasonable choice since it 
> > is flexible and (almost) clear, and since HTTPS, as a major user of TLS, 
> > is, I assume, well analysed for security implications wrt certificate 
> > validation. 
> >     
>
> More fun:
> https://bugzilla.mozilla.org/show_bug.cgi?id=159483
>   
Aargh!  I'm half way down this discussion and already I'd prefer to 
stick needless in my eyes.  So far though consensus seems to be RFC 2818 
rules for wildcards.  I notice some of the test patterns suggested would 
not work in libESMTP as it stands.
>   
> > Is it the case that for STARTTLS in SMTP what we are really interested 
> > in is encrypting the data on the wire and authentication is only of 
> > secondary importance?
> >     
>
> Encryption without authentication makes you prone to MITM.
>   
Indeed.
>   
> > Do we know what the best current practice is 
> > among CAs when it comes to issuing certificates for STARTTLS?
> >     
>
> The most common implementation is to just allow the simple form
> *.something so I'd assume that other patterns are rare in the wild.
> The last commenter in the aforementioned Mozilla bug says that
> *.*.appspot.com is actually used by Google though.
>
> Anyways, the matching function in libesmtp certainly is good enough.
> I was just surprised that wildcards at the right hand side are
> allowed. What about the actual patch I sent though? :-)
>   
I'm happy that the patch jumps through the right hoops though I'm rather 
out of touch with the OpenSSL APIs these days so there is a certain 
element of trust here :-)

However I did realise there is another problem with the wildcard match.  
Currently match_component() just steps over text when it sees the '*', 
however it should really be like a character class i.e. the RE 
'[-A-Za-z0-9]*'.  Currently * will match any old junk in the hostname 
including punctuation and control codes which gives a possibility of 
attacking a system using specially crafted hostnames.  I shall modify 
match_component() to deal with this and other issues that may be 
relevant, after I've waded through the rest of the mozilla thread.
> cu
> Ludwig
>
>   
Rergards
Brian