Bug 585393 (CVE-2010-1192) - VUL-0: CVE-2010-1192 CVE-2010-1194: libesmtp: does not check NULL bytes in commonName
Summary: VUL-0: CVE-2010-1192 CVE-2010-1194: libesmtp: does not check NULL bytes in co...
Status: RESOLVED FIXED
Alias: CVE-2010-1192
Product: SUSE Security Incidents
Classification: Novell Products
Component: General (show other bugs)
Version: unspecified
Hardware: Other Other
: P5 - None : Normal
Target Milestone: ---
Deadline: 2010-04-01
Assignee: Security Team bot
QA Contact: Security Team bot
URL:
Whiteboard: maint:released:11.0:33092 maint:relea...
Keywords:
Depends on:
Blocks:
 
Reported: 2010-03-04 09:37 UTC by Ludwig Nussel
Modified: 2016-12-27 17:57 UTC (History)
5 users (show)

See Also:
Found By: Other
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments
patch (4.78 KB, patch)
2010-03-17 13:45 UTC, Ludwig Nussel
Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Ludwig Nussel 2010-03-04 09:37:50 UTC
Your friendly security team received the following report via oss-security.
Please respond ASAP.
The issue is public.

Date: Wed, 3 Mar 2010 13:58:45 -0800
From: Kees Cook <kees@ubuntu.com>
To: oss-security@lists.openwall.com,
 libesmtp@stafford.uklinux.net
Subject: [oss-security] CVE Request: libesmtp does not check NULL bytes in commonName
CC: security@ubuntu.com

Hello,

I just noticed that libesmtp does not appear to handle NULL-byte CNs, as
seen with the original browser-based issue:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2408

Related to this are failures in wildcard handling:
 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=311191
and CN-specificity:
 https://bugzilla.redhat.com/show_bug.cgi?id=510202

Though it may be a non-issue if TLS doesn't function at all:
 http://bugs.gentoo.org/213066

-Kees

-- 
Kees Cook
Ubuntu Security Team
Comment 1 Swamp Workflow Management 2010-03-05 14:13:55 UTC
The SWAMPID for this issue is 31749.
Please submit the patch and patchinfo file using this ID.
(https://swamp.suse.de/webswamp/wf/31749)
Comment 2 Klaas Freitag 2010-03-09 17:58:18 UTC
What Ludwig found out for me is that this problem only happens with SSL in use. Upstream is no activity providing a patch. 

A simple fix would be to disable ssl for the package. Would that be a way to go?
Comment 3 Sebastian Krahmer 2010-03-10 08:39:33 UTC
Date: Tue, 09 Mar 2010 19:00:57 +0100
From: Jan Lieskovsky <jlieskov@redhat.com>
Reply-To: oss-security <oss-security@lists.openwall.com>
User-Agent: Thunderbird 2.0.0.23 (X11/20090825)
To: "Steven M. Christey" <coley@linus.mitre.org>,
        Kees Cook <kees@ubuntu.com>
Cc: Brian Stafford <brian@stafford.uklinux.net>,
        oss-security <oss-security@lists.openwall.com>,
        libesmtp@stafford.uklinux.net, security@ubuntu.com

Hi Steve,

Kees Cook wrote:
>Hello,
>
>I just noticed that libesmtp does not appear to handle NULL-byte CNs, as
>seen with the original browser-based issue:
>http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2408
>
>Related to this are failures in wildcard handling:
> http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=311191
>and CN-specificity:
> https://bugzilla.redhat.com/show_bug.cgi?id=510202
>
>Though it may be a non-issue if TLS doesn't function at all:
> http://bugs.gentoo.org/213066

  any progress while assigning CVE ids for these issues?

  From what I can tell, two should be enough:
  a, libESMTP doesn't properly handle NULL character in Common Name

    References:
      http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2408
      http://ioactive.com/pdfs/PKILayerCake.pdf (issue 2c)

  b, libESMTP's match_component() accepts two strings as equal
     if they start equal but don't have equal length => cert forgery

    References:
      http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=311191

  Kees, please correct me, if I omitted something.

Thanks && Regards, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Response Team
Comment 4 Ludwig Nussel 2010-03-10 16:04:04 UTC
I've created a patch and sent it to oss-sec for review
Comment 5 Ludwig Nussel 2010-03-17 13:45:49 UTC
Created attachment 348908 [details]
patch

The patch after upstream review. Discussion is not fully finished yet though.
Comment 6 Ludwig Nussel 2010-04-01 07:37:38 UTC
Date: Tue, 30 Mar 2010 16:34:35 -0400 (EDT)
From: "Steven M. Christey" <coley@linus.mitre.org>
Subject: Re: [oss-security] CVE Request: libesmtp does not check NULL bytes
 in commonName


On Wed, 3 Mar 2010, Kees Cook wrote:

> I just noticed that libesmtp does not appear to handle NULL-byte CNs, as
> seen with the original browser-based issue:
> http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2408

Use CVE-2010-1192

> Related to this are failures in wildcard handling:
> http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=311191

Use CVE-2010-1194

I'm guessing that upstream 1.0.4 and earlier are affected by both 
problems.

- Steve
Comment 7 Ludwig Nussel 2010-04-16 07:27:57 UTC
AFAICT the patch is good enough, please go ahead
Comment 8 Ludwig Nussel 2010-04-26 12:29:48 UTC
Klaas?
Comment 9 Klaas Freitag 2010-04-28 08:19:51 UTC
Submitted a patches package to GNOME:Factory, which is the devel repo for openSUSE:Factory. Submit-Request-ID is 38974
Comment 10 Klaas Freitag 2010-04-28 08:20:27 UTC
I meant I submitted a _patched_ package of course, sorry.
Comment 11 Klaas Freitag 2010-04-30 09:29:42 UTC
Submitted a patched package to openSUSE 11.0, openSUSE 11.1 and openSUSE 11.2 through the external BS, for SLE 11 in internal BS.

Anything else I have to provide?
Comment 12 Ludwig Nussel 2010-04-30 12:26:31 UTC
nope, thanks
Comment 13 Thomas Biege 2010-05-05 12:14:12 UTC
released
Comment 14 Swamp Workflow Management 2010-05-05 12:14:24 UTC
Update released for: libesmtp, libesmtp-debuginfo, libesmtp-debugsource, libesmtp-devel
Products:
openSUSE 11.0 (debug, i386, ppc, x86_64)
openSUSE 11.1 (debug, i586, ppc, x86_64)
openSUSE 11.2 (debug, i586, x86_64)
Comment 15 Swamp Workflow Management 2010-05-05 14:48:52 UTC
Update released for: libesmtp, libesmtp-debuginfo, libesmtp-debugsource, libesmtp-devel
Products:
SLE-DEBUGINFO 11 (i386, ia64, ppc64, s390x, x86_64)
SLE-SDK 11 (i386, ia64, ppc64, s390x, x86_64)
SLE-SERVER 11 (i386, ia64, ppc64, s390x, x86_64)
Comment 16 Bernhard Wiedemann 2016-04-15 10:52:11 UTC
This is an autogenerated message for OBS integration:
This bug (585393) was mentioned in
https://build.opensuse.org/request/show/39315 Factory / libesmtp