oss-sec mailing list archives
Re: CVE Request: libesmtp does not check NULL bytes in commonName
From: Ludwig Nussel <ludwig.nussel () suse de>
Date: Thu, 11 Mar 2010 14:42:32 +0100
Brian Stafford wrote:
Ludwig Nussel wrote:The attached patch includes the patch from Debian. However, the match_domain() function probably should be rewritten anyways I guess. It matches patters such as 'foo.bar.*' which is rather weird.[...] RFC 2818 does not constrain which domain name components may contain wildcards. Names such as *.bar.com, foo.*.com and foo.bar.* are therefore all valid despite the latter two cases appearing unconventional. The examples from RFC 2818 show wildcards only in the leading domain name components. Examples are neither normative nor exhaustive and may not therefore imply constraints or extensions of a standard's normative text. Comparison bugs aside, I believe that libESMTP's behaviour correctly implements RFC 2818 in this respect.
Hmm. Yes, RFC 2818 could be interpretet that way. RFCs 2595 (IMAP), 4642 (NNTP) and 4513 (LDAP) restrict wildcards to the leftmost component. The LDAP one doesn't allow wildcards in CN's though and none of them explicitly disallows use of the CN if a subjAltname is present. RFC 3207 (SMTP) doesn't tell how matching should be performed. perl-IO-Socket therefore doesn't allow wildcards for smtp. perl-IO-Socket has the most flexible implementation I've seen so far but intentionally only supports one wildcard at the leftmost side. What a mess. cu Ludwig -- (o_ Ludwig Nussel //\ V_/_ http://www.suse.de/ SUSE LINUX Products GmbH, GF: Markus Rex, HRB 16746 (AG Nuernberg)
Current thread:
- CVE Request: libesmtp does not check NULL bytes in commonName Kees Cook (Mar 03)
- Re: CVE Request: libesmtp does not check NULL bytes in commonName Jan Lieskovsky (Mar 09)
- Re: CVE Request: libesmtp does not check NULL bytes in commonName Ludwig Nussel (Mar 10)
- Re: CVE Request: libesmtp does not check NULL bytes in commonName Brian Stafford (Mar 10)
- Re: CVE Request: libesmtp does not check NULL bytes in commonName Ludwig Nussel (Mar 11)
- Re: CVE Request: libesmtp does not check NULL bytes in commonName Brian Stafford (Mar 11)
- Re: CVE Request: libesmtp does not check NULL bytes in commonName Ludwig Nussel (Mar 11)
- Re: CVE Request: libesmtp does not check NULL bytes in commonName Brian Stafford (Mar 11)
- Re: CVE Request: libesmtp does not check NULL bytes in commonName Brian Stafford (Mar 15)
- Re: CVE Request: libesmtp does not check NULL bytes in commonName Ludwig Nussel (Mar 16)
- Re: CVE Request: libesmtp does not check NULL bytes in commonName Brian Stafford (Mar 16)
- Re: CVE Request: libesmtp does not check NULL bytes in commonName ArkanoiD (Mar 16)
- Re: CVE Request: libesmtp does not check NULL bytes in commonName Ludwig Nussel (Mar 16)
- Re: CVE Request: libesmtp does not check NULL bytes in commonName Peter Sylvester (Mar 16)
- Re: CVE Request: libesmtp does not check NULL bytes in commonName ArkanoiD (Mar 16)
- Re: CVE Request: libesmtp does not check NULL bytes in commonName Ludwig Nussel (Mar 10)
- Re: CVE Request: libesmtp does not check NULL bytes in commonName Jan Lieskovsky (Mar 09)