1. CVE-Search
  2. CVE-2010-1192
ID CVE-2010-1192
Summary libESMTP, probably 1.0.4 and earlier, does not properly handle a '\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.
References
Vulnerable Configurations
  • cpe:2.3:a:stafford.uklinux:libesmtp:0.1:-:*:*:*:*:*:*
    cpe:2.3:a:stafford.uklinux:libesmtp:0.1:-:*:*:*:*:*:*
  • cpe:2.3:a:stafford.uklinux:libesmtp:0.1:a:*:*:*:*:*:*
    cpe:2.3:a:stafford.uklinux:libesmtp:0.1:a:*:*:*:*:*:*
  • cpe:2.3:a:stafford.uklinux:libesmtp:0.2:*:*:*:*:*:*:*
    cpe:2.3:a:stafford.uklinux:libesmtp:0.2:*:*:*:*:*:*:*
  • cpe:2.3:a:stafford.uklinux:libesmtp:0.3:*:*:*:*:*:*:*
    cpe:2.3:a:stafford.uklinux:libesmtp:0.3:*:*:*:*:*:*:*
  • cpe:2.3:a:stafford.uklinux:libesmtp:0.4:*:*:*:*:*:*:*
    cpe:2.3:a:stafford.uklinux:libesmtp:0.4:*:*:*:*:*:*:*
  • cpe:2.3:a:stafford.uklinux:libesmtp:0.5:*:*:*:*:*:*:*
    cpe:2.3:a:stafford.uklinux:libesmtp:0.5:*:*:*:*:*:*:*
  • cpe:2.3:a:stafford.uklinux:libesmtp:0.6:*:*:*:*:*:*:*
    cpe:2.3:a:stafford.uklinux:libesmtp:0.6:*:*:*:*:*:*:*
  • cpe:2.3:a:stafford.uklinux:libesmtp:0.6:a:*:*:*:*:*:*
    cpe:2.3:a:stafford.uklinux:libesmtp:0.6:a:*:*:*:*:*:*
  • cpe:2.3:a:stafford.uklinux:libesmtp:0.6.1:*:*:*:*:*:*:*
    cpe:2.3:a:stafford.uklinux:libesmtp:0.6.1:*:*:*:*:*:*:*
  • cpe:2.3:a:stafford.uklinux:libesmtp:0.7.0:*:*:*:*:*:*:*
    cpe:2.3:a:stafford.uklinux:libesmtp:0.7.0:*:*:*:*:*:*:*
  • cpe:2.3:a:stafford.uklinux:libesmtp:0.7.1:*:*:*:*:*:*:*
    cpe:2.3:a:stafford.uklinux:libesmtp:0.7.1:*:*:*:*:*:*:*
  • cpe:2.3:a:stafford.uklinux:libesmtp:0.8.0:*:*:*:*:*:*:*
    cpe:2.3:a:stafford.uklinux:libesmtp:0.8.0:*:*:*:*:*:*:*
  • cpe:2.3:a:stafford.uklinux:libesmtp:0.8.1:*:*:*:*:*:*:*
    cpe:2.3:a:stafford.uklinux:libesmtp:0.8.1:*:*:*:*:*:*:*
  • cpe:2.3:a:stafford.uklinux:libesmtp:0.8.2:*:*:*:*:*:*:*
    cpe:2.3:a:stafford.uklinux:libesmtp:0.8.2:*:*:*:*:*:*:*
  • cpe:2.3:a:stafford.uklinux:libesmtp:0.8.3:*:*:*:*:*:*:*
    cpe:2.3:a:stafford.uklinux:libesmtp:0.8.3:*:*:*:*:*:*:*
  • cpe:2.3:a:stafford.uklinux:libesmtp:0.8.4:*:*:*:*:*:*:*
    cpe:2.3:a:stafford.uklinux:libesmtp:0.8.4:*:*:*:*:*:*:*
  • cpe:2.3:a:stafford.uklinux:libesmtp:0.8.5:*:*:*:*:*:*:*
    cpe:2.3:a:stafford.uklinux:libesmtp:0.8.5:*:*:*:*:*:*:*
  • cpe:2.3:a:stafford.uklinux:libesmtp:0.8.6:*:*:*:*:*:*:*
    cpe:2.3:a:stafford.uklinux:libesmtp:0.8.6:*:*:*:*:*:*:*
  • cpe:2.3:a:stafford.uklinux:libesmtp:0.8.7:*:*:*:*:*:*:*
    cpe:2.3:a:stafford.uklinux:libesmtp:0.8.7:*:*:*:*:*:*:*
  • cpe:2.3:a:stafford.uklinux:libesmtp:0.8.8:*:*:*:*:*:*:*
    cpe:2.3:a:stafford.uklinux:libesmtp:0.8.8:*:*:*:*:*:*:*
  • cpe:2.3:a:stafford.uklinux:libesmtp:0.8.9:*:*:*:*:*:*:*
    cpe:2.3:a:stafford.uklinux:libesmtp:0.8.9:*:*:*:*:*:*:*
  • cpe:2.3:a:stafford.uklinux:libesmtp:0.8.10:*:*:*:*:*:*:*
    cpe:2.3:a:stafford.uklinux:libesmtp:0.8.10:*:*:*:*:*:*:*
  • cpe:2.3:a:stafford.uklinux:libesmtp:0.8.10:p1:*:*:*:*:*:*
    cpe:2.3:a:stafford.uklinux:libesmtp:0.8.10:p1:*:*:*:*:*:*
  • cpe:2.3:a:stafford.uklinux:libesmtp:0.8.11:*:*:*:*:*:*:*
    cpe:2.3:a:stafford.uklinux:libesmtp:0.8.11:*:*:*:*:*:*:*
  • cpe:2.3:a:stafford.uklinux:libesmtp:0.8.12:*:*:*:*:*:*:*
    cpe:2.3:a:stafford.uklinux:libesmtp:0.8.12:*:*:*:*:*:*:*
  • cpe:2.3:a:stafford.uklinux:libesmtp:1.0:*:*:*:*:*:*:*
    cpe:2.3:a:stafford.uklinux:libesmtp:1.0:*:*:*:*:*:*:*
  • cpe:2.3:a:stafford.uklinux:libesmtp:1.0:rc1:*:*:*:*:*:*
    cpe:2.3:a:stafford.uklinux:libesmtp:1.0:rc1:*:*:*:*:*:*
  • cpe:2.3:a:stafford.uklinux:libesmtp:1.0.1:*:*:*:*:*:*:*
    cpe:2.3:a:stafford.uklinux:libesmtp:1.0.1:*:*:*:*:*:*:*
  • cpe:2.3:a:stafford.uklinux:libesmtp:1.0.2:*:*:*:*:*:*:*
    cpe:2.3:a:stafford.uklinux:libesmtp:1.0.2:*:*:*:*:*:*:*
  • cpe:2.3:a:stafford.uklinux:libesmtp:1.0.3:*:*:*:*:*:*:*
    cpe:2.3:a:stafford.uklinux:libesmtp:1.0.3:*:*:*:*:*:*:*
  • cpe:2.3:a:stafford.uklinux:libesmtp:*:*:*:*:*:*:*:*
    cpe:2.3:a:stafford.uklinux:libesmtp:*:*:*:*:*:*:*:*
CVSS
Base: 6.8 (as of 22-05-2010 - 05:46)
Impact:
Exploitability:
CWE CWE-310
CAPEC
  • Signature Spoofing by Key Recreation
    An attacker obtains an authoritative or reputable signer's private signature key by exploiting a cryptographic weakness in the signature algorithm or pseudorandom number generation and then uses this key to forge signatures from the original signer to mislead a victim into performing actions that benefit the attacker.
Access
VectorComplexityAuthentication
NETWORK MEDIUM NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL PARTIAL PARTIAL
cvss-vector via4 AV:N/AC:M/Au:N/C:P/I:P/A:P
refmap via4
mlist
  • [oss-security] 20100303 CVE Request: libesmtp does not check NULL bytes in commonName
  • [oss-security] 20100309 Re: CVE Request: libesmtp does not check NULL bytes in commonName
suse SUSE-SR:2010:011
vupen ADV-2010-1107
Last major update 22-05-2010 - 05:46
Published 31-03-2010 - 18:00
Last modified 22-05-2010 - 05:46
Back to Top