Nom du paquet
libesmtp
Date
2010-10-04
Advisory ID
MDVSA-2010:195
Affected versions
2009.0 x86_64 , MES5 i586 , 2010.1 i586 , 2010.0 x86_64 , 2010.0 i586 , 2009.1 i586 , 2009.0 i586 , CS4.0 i586 , 2008.0 x86_64 , CS4.0 x86_64 , 2008.0 i586 , 2009.1 x86_64 , MES5 x86_64 , 2010.1 x86_64

Problem description

Multiple vulnerabilities has been found and corrected in libesmtp:

libESMTP, probably 1.0.4 and earlier, does not properly handle a \'\0\'
(NUL) character in a domain name in the subject's Common Name (CN)
field of an X.509 certificate, which allows man-in-the-middle attackers
to spoof arbitrary SSL servers via a crafted certificate issued by a
legitimate Certification Authority, a related issue to CVE-2009-2408
(CVE-2010-1192).

The match_component function in smtp-tls.c in libESMTP 1.0.3.r1, and
possibly other versions including 1.0.4, treats two strings as equal if
one is a substring of the other, which allows remote attackers to spoof
trusted certificates via a crafted subjectAltName (CVE-2010-1194).

Packages for 2008.0 and 2009.0 are provided as of the Extended
Maintenance Program. Please visit this link to learn more:
http://store.mandriva.com/product_info.php?cPath=149&products_id=490

The updated packages have been patched to correct these issues.

Updated packages

2009.0 x86_64

 85583d41d8b45be05d893af5756ec8d2  2009.0/x86_64/lib64esmtp5-1.0.4-4.1mdv2009.0.x86_64.rpm
 2c9cfdf87cd3d1e91792d7e9d4dbdc80  2009.0/x86_64/lib64esmtp-devel-1.0.4-4.1mdv2009.0.x86_64.rpm 
 2405545e5e3e9cf3a60b0edbbafc61b9  2009.0/SRPMS/libesmtp-1.0.4-4.1mdv2009.0.src.rpm

MES5 i586

 700aaa77ad5f282e2df2049bd7132fe2  mes5/i586/libesmtp5-1.0.4-4.1mdvmes5.1.i586.rpm
 71c70f199708b4e5e9a91dae8e2d680d  mes5/i586/libesmtp-devel-1.0.4-4.1mdvmes5.1.i586.rpm 
 102df9e6ed4321d9580911c5806be92f  mes5/SRPMS/libesmtp-1.0.4-4.1mdvmes5.1.src.rpm

2010.1 i586

 5499b0406f43651b5fffd6b5223c0d38  2010.1/i586/libesmtp5-1.0.4-8.1mdv2010.1.i586.rpm
 169b22760527862bf65d074179112ac3  2010.1/i586/libesmtp-devel-1.0.4-8.1mdv2010.1.i586.rpm 
 06903188f0a5201dd2288cc1126a499f  2010.1/SRPMS/libesmtp-1.0.4-8.1mdv2010.1.src.rpm

2010.0 x86_64

 e3dc2c0ced2c25f3ac5ae63931a7f67e  2010.0/x86_64/lib64esmtp5-1.0.4-6.1mdv2010.0.x86_64.rpm
 4e1ac4edd11f17dc1e3607be87984077  2010.0/x86_64/lib64esmtp-devel-1.0.4-6.1mdv2010.0.x86_64.rpm 
 5047b7270f09adffaf5202df4ec4e2cd  2010.0/SRPMS/libesmtp-1.0.4-6.1mdv2010.0.src.rpm

2010.0 i586

 4e992cfb253ac51c72ff420d2862fe35  2010.0/i586/libesmtp5-1.0.4-6.1mdv2010.0.i586.rpm
 fdccc3a0c98049bb236eeecd7869e666  2010.0/i586/libesmtp-devel-1.0.4-6.1mdv2010.0.i586.rpm 
 5047b7270f09adffaf5202df4ec4e2cd  2010.0/SRPMS/libesmtp-1.0.4-6.1mdv2010.0.src.rpm

2009.1 i586

 fbbae5b5574e8e014253cb5d1f5cfca0  2009.1/i586/libesmtp5-1.0.4-5.1mdv2009.1.i586.rpm
 6e08c2b25ea7200bba7a22e2ba7e2bfa  2009.1/i586/libesmtp-devel-1.0.4-5.1mdv2009.1.i586.rpm 
 f2d40725974760c629e0bb296176f1ec  2009.1/SRPMS/libesmtp-1.0.4-5.1mdv2009.1.src.rpm

2009.0 i586

 43e4795d0259c57eefd34d9662b1182d  2009.0/i586/libesmtp5-1.0.4-4.1mdv2009.0.i586.rpm
 f1436a52a7ffcc8f38b2d6617e8324eb  2009.0/i586/libesmtp-devel-1.0.4-4.1mdv2009.0.i586.rpm 
 2405545e5e3e9cf3a60b0edbbafc61b9  2009.0/SRPMS/libesmtp-1.0.4-4.1mdv2009.0.src.rpm

CS4.0 i586

 7b2868bc2a7a58d921126c333c6862b1  corporate/4.0/i586/libesmtp5-1.0.4-0.1.20060mlcs4.i586.rpm
 febd67c3c2c68d8798c17cadfc3c79a8  corporate/4.0/i586/libesmtp5-devel-1.0.4-0.1.20060mlcs4.i586.rpm 
 f2dbeb8bec24531e717b72608b8d5659  corporate/4.0/SRPMS/libesmtp-1.0.4-0.1.20060mlcs4.src.rpm

2008.0 x86_64

 7f9003c599ceef90b25d7f0582515a66  2008.0/x86_64/lib64esmtp5-1.0.4-1.1mdv2008.0.x86_64.rpm
 530085f77adcd0dec9e3fb154b0c8c2b  2008.0/x86_64/lib64esmtp5-devel-1.0.4-1.1mdv2008.0.x86_64.rpm 
 66721fe590c7b76c26b7f167d3b8d4a4  2008.0/SRPMS/libesmtp-1.0.4-1.1mdv2008.0.src.rpm

CS4.0 x86_64

 b0f3670dc01c62ea4f100ad41c4d9fc3  corporate/4.0/x86_64/lib64esmtp5-1.0.4-0.1.20060mlcs4.x86_64.rpm
 065c29c3aa0a708c11602bf7ef029782  corporate/4.0/x86_64/lib64esmtp5-devel-1.0.4-0.1.20060mlcs4.x86_64.rpm 
 f2dbeb8bec24531e717b72608b8d5659  corporate/4.0/SRPMS/libesmtp-1.0.4-0.1.20060mlcs4.src.rpm

2008.0 i586

 d5d325c2a9394b23714c60c230146162  2008.0/i586/libesmtp5-1.0.4-1.1mdv2008.0.i586.rpm
 01e2b2aee7b00bb2c1c63628750ce61a  2008.0/i586/libesmtp5-devel-1.0.4-1.1mdv2008.0.i586.rpm 
 66721fe590c7b76c26b7f167d3b8d4a4  2008.0/SRPMS/libesmtp-1.0.4-1.1mdv2008.0.src.rpm

2009.1 x86_64

 ee3ff7a9b146f55eccaaefeb966eb473  2009.1/x86_64/lib64esmtp5-1.0.4-5.1mdv2009.1.x86_64.rpm
 fd3300fcc6a99b084b5fc5cb69478feb  2009.1/x86_64/lib64esmtp-devel-1.0.4-5.1mdv2009.1.x86_64.rpm 
 f2d40725974760c629e0bb296176f1ec  2009.1/SRPMS/libesmtp-1.0.4-5.1mdv2009.1.src.rpm

MES5 x86_64

 403dbe77fd8e01c679ed8113f31068f6  mes5/x86_64/lib64esmtp5-1.0.4-4.1mdvmes5.1.x86_64.rpm
 3a55f65b981f961081dc5087fc9ca365  mes5/x86_64/lib64esmtp-devel-1.0.4-4.1mdvmes5.1.x86_64.rpm 
 102df9e6ed4321d9580911c5806be92f  mes5/SRPMS/libesmtp-1.0.4-4.1mdvmes5.1.src.rpm

2010.1 x86_64

 da58a753b506123906c752350ee79168  2010.1/x86_64/lib64esmtp5-1.0.4-8.1mdv2010.1.x86_64.rpm
 b9b453aecbaa9740e5b2aaf0538975e5  2010.1/x86_64/lib64esmtp-devel-1.0.4-8.1mdv2010.1.x86_64.rpm 
 06903188f0a5201dd2288cc1126a499f  2010.1/SRPMS/libesmtp-1.0.4-8.1mdv2010.1.src.rpm

References