FreeBSD : fetchmail -- improper SSL certificate subject verification (5179d85c-8683-11de-91b9-0022157515b2)

Matthias Andree reports : Moxie Marlinspike demonstrated in July 2009 that some CAs would sign certificates that contain embedded NUL characters in the Common Name or subjectAltName fields of ITU-T X.509 certificates. Applications that would treat such X.509 strings as NUL-terminated C strings...

openSUSE Security Update : fetchmail (fetchmail-1179)

This update of fetchmail improves SSL certificate validation to stop possible man-in-the-middle attacks by inserting \0-character in the certificate's subject name. CVE-2009-2666 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were...

Fetchmail SSL证书空字符验证漏洞

BUGTRAQ ID: 35951 CVECAN ID: CVE-2009-2666 Fetchmail是免费的软件包，可以从远程POP2、POP3、IMAP、ETRN或ODMR服务器检索邮件并将其转发给本地SMTP、LMTP服务器或消息传送代理。 一些CA所签名的证书在ITU-T X.509证书的Common Name或subjectAltName字段中包含有嵌入的空字符，Fetchmail在处理这种X.509字符串时会将其处理为终止符，因此只会检查空字符的之前部分。例如，名称为www.good.example\0www.bad.example.com...

fetchmail security announcement fetchmail-SA-2009-01 (CVE-2009-2666)

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 fetchmail-SA-2009-01: Improper SSL certificate subject verification Topics: Improper SSL certificate subject verification Author: Matthias Andree Version: 1.0 Announced: 2009-08-06 Type: Allows undetected Man-in-the-middle attacks against SSL/TLS...

[SECURITY] [DSA 1852-1] New fetchmail packages fix SSL certificate verification weakness

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -------------------------------------------------------------------------- Debian Security Advisory DSA-1852-1 [email protected] http://www.debian.org/security/ Nico Golde August 7th, 2009 http://www.debian.org/security/faq -...

fetchmail certificate spoofing

It's possible to spoof certificate name with NULL byte in prefix...

CVE-2009-2666

socket.c in fetchmail before 6.3.11 does not properly handle a '\0' character in a domain name in the subject's Common Name CN field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification...

DEBIAN-CVE-2009-2666

socket.c in fetchmail before 6.3.11 does not properly handle a '\0' character in a domain name in the subject's Common Name CN field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification...

CVE-2009-2666

socket.c in fetchmail before 6.3.11 does not properly handle a '\0' character in a domain name in the subject's Common Name CN field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification...

Design/Logic Flaw

socket.c in fetchmail before 6.3.11 does not properly handle a '\0' character in a domain name in the subject's Common Name CN field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification...

CVE-2009-2666

socket.c in fetchmail before 6.3.11 does not properly handle a '\0' character in a domain name in the subject's Common Name CN field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification...

CVE-2009-2666

socket.c in fetchmail before 6.3.11 does not properly handle a '\0' character in a domain name in the subject's Common Name CN field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification...

CVE-2009-2666

Technical details for CVE-2009-2666 are not present in the provided connected documents. The description here references a domain-name '\0' handling issue in fetchmail, but no vendor/product/version specifics or mitigations are included in the supplied materials. Monitor for updates.

CVE-2009-2666

socket.c in fetchmail before 6.3.11 does not properly handle a '\0' character in a domain name in the subject's Common Name CN field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification...

[SECURITY] [DSA 1852-1] New fetchmail packages fix SSL certificate verification weakness

-------------------------------------------------------------------------- Debian Security Advisory DSA-1852-1 [email protected] http://www.debian.org/security/ Nico Golde August 7th, 2009 http://www.debian.org/security/faq -...

DSA-1852-1 fetchmail - SSL certificate verification weakness

Bulletin has no description...

Slackware 10.0 / 10.1 / 10.2 / 11.0 / 12.0 / 12.1 / 12.2 / 8.1 / 9.0 / 9.1 / current : fetchmail (SSA:2009-218-01)

New fetchmail packages are available for Slackware 8.1, 9.0, 9.1, 10.0, 10.1, 10.2, 11.0, 12.0, 12.1, 12.2, and -current to a fix security issue. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Slackware Security...

fetchmail

New fetchmail packages are available for Slackware 8.1, 9.0, 9.1, 10.0, 10.1, 10.2, 11.0, 12.0, 12.1, 12.2, and -current to a fix security issue. More details about this issue may be found in the Common Vulnerabilities and Exposures CVE database: https://vulners.com/cve/CVE-2009-2666 Here are the...

Fetchmail NULL字符CA SSL整数验证安全绕过漏洞

Bugraq ID: 35951 Fetchmail是一款功能强大的IMAP和POP客户程序。 Fetchmail不正确验证签名CA证书中包含NULL字符的域名，允许攻击者使用恶意SSL证书替换可信证书，绕过安全检测进行中间人攻击或伪造可信服务器，获得敏感信息。 Fetchmail Fetchmail 6.3.10 Fetchmail Fetchmail 6.3.9 Fetchmail Fetchmail 6.3.8 Fetchmail Fetchmail 6.3.7 Fetchmail Fetchmail 6.3.6 -rc3 Fetchmail Fetchmail 6.3.6 -rc...

fetchmail -- improper SSL certificate subject verification

Matthias Andree reports: Moxie Marlinspike demonstrated in July 2009 that some CAs would sign certificates that contain embedded NUL characters in the Common Name or subjectAltName fields of ITU-T X.509 certificates. Applications that would treat such X.509 strings as NUL-terminated C strings...