894 matches found
openSUSE Security Update : fetchmail (fetchmail-1179)
This update of fetchmail improves SSL certificate validation to stop possible man-in-the-middle attacks by inserting \0-character in the certificate's subject name. CVE-2009-2666 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were...
openSUSE Security Update : fetchmail (fetchmail-1179)
This update of fetchmail improves SSL certificate validation to stop possible man-in-the-middle attacks by inserting \0-character in the certificate's subject name. CVE-2009-2666 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were...
Fetchmail SSL证书空字符验证漏洞
BUGTRAQ ID: 35951 CVECAN ID: CVE-2009-2666 Fetchmail是免费的软件包，可以从远程POP2、POP3、IMAP、ETRN或ODMR服务器检索邮件并将其转发给本地SMTP、LMTP服务器或消息传送代理。 一些CA所签名的证书在ITU-T X.509证书的Common Name或subjectAltName字段中包含有嵌入的空字符，Fetchmail在处理这种X.509字符串时会将其处理为终止符，因此只会检查空字符的之前部分。例如，名称为www.good.example\0www.bad.example.com...
fetchmail certificate spoofing
It's possible to spoof certificate name with NULL byte in prefix...
fetchmail security announcement fetchmail-SA-2009-01 (CVE-2009-2666)
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 fetchmail-SA-2009-01: Improper SSL certificate subject verification Topics: Improper SSL certificate subject verification Author: Matthias Andree Version: 1.0 Announced: 2009-08-06 Type: Allows undetected Man-in-the-middle attacks against SSL/TLS...
[SECURITY] [DSA 1852-1] New fetchmail packages fix SSL certificate verification weakness
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - -------------------------------------------------------------------------- Debian Security Advisory DSA-1852-1 [email protected] http://www.debian.org/security/ Nico Golde August 7th, 2009 http://www.debian.org/security/faq -...
CVE-2009-2666
socket.c in fetchmail before 6.3.11 does not properly handle a '\0' character in a domain name in the subject's Common Name CN field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification...
DEBIAN-CVE-2009-2666
socket.c in fetchmail before 6.3.11 does not properly handle a '\0' character in a domain name in the subject's Common Name CN field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification...
CVE-2009-2666
socket.c in fetchmail before 6.3.11 does not properly handle a '\0' character in a domain name in the subject's Common Name CN field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification...
CVE-2009-2666
socket.c in fetchmail before 6.3.11 does not properly handle a '\0' character in a domain name in the subject's Common Name CN field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification...
Design/Logic Flaw
socket.c in fetchmail before 6.3.11 does not properly handle a '\0' character in a domain name in the subject's Common Name CN field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification...
CVE-2009-2666
socket.c in fetchmail before 6.3.11 does not properly handle a '\0' character in a domain name in the subject's Common Name CN field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification...
CVE-2009-2666
Technical details for CVE-2009-2666 are not present in the provided connected documents. The description here references a domain-name '\0' handling issue in fetchmail, but no vendor/product/version specifics or mitigations are included in the supplied materials. Monitor for updates.
CVE-2009-2666
socket.c in fetchmail before 6.3.11 does not properly handle a '\0' character in a domain name in the subject's Common Name CN field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification...
[SECURITY] [DSA 1852-1] New fetchmail packages fix SSL certificate verification weakness
-------------------------------------------------------------------------- Debian Security Advisory DSA-1852-1 [email protected] http://www.debian.org/security/ Nico Golde August 7th, 2009 http://www.debian.org/security/faq -...
Slackware 10.0 / 10.1 / 10.2 / 11.0 / 12.0 / 12.1 / 12.2 / 8.1 / 9.0 / 9.1 / current : fetchmail (SSA:2009-218-01)
New fetchmail packages are available for Slackware 8.1, 9.0, 9.1, 10.0, 10.1, 10.2, 11.0, 12.0, 12.1, 12.2, and -current to a fix security issue. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Slackware Security...
DSA-1852-1 fetchmail - SSL certificate verification weakness
Bulletin has no description...
fetchmail
New fetchmail packages are available for Slackware 8.1, 9.0, 9.1, 10.0, 10.1, 10.2, 11.0, 12.0, 12.1, 12.2, and -current to a fix security issue. More details about this issue may be found in the Common Vulnerabilities and Exposures CVE database: https://vulners.com/cve/CVE-2009-2666 Here are the...
Fetchmail NULL字符CA SSL整数验证安全绕过漏洞
Bugraq ID: 35951 Fetchmail是一款功能强大的IMAP和POP客户程序。 Fetchmail不正确验证签名CA证书中包含NULL字符的域名，允许攻击者使用恶意SSL证书替换可信证书，绕过安全检测进行中间人攻击或伪造可信服务器，获得敏感信息。 Fetchmail Fetchmail 6.3.10 Fetchmail Fetchmail 6.3.9 Fetchmail Fetchmail 6.3.8 Fetchmail Fetchmail 6.3.7 Fetchmail Fetchmail 6.3.6 -rc3 Fetchmail Fetchmail 6.3.6 -rc...
fetchmail -- improper SSL certificate subject verification
Matthias Andree reports: Moxie Marlinspike demonstrated in July 2009 that some CAs would sign certificates that contain embedded NUL characters in the Common Name or subjectAltName fields of ITU-T X.509 certificates. Applications that would treat such X.509 strings as NUL-terminated C strings...