Back to search
CVE-2010-1194
Published: Mar 31, 2010
Modified: Aug 7, 2024
PUBLISHED
Description
The match_component function in smtp-tls.c in libESMTP 1.0.3.r1, and possibly other versions including 1.0.4, treats two strings as equal if one is a substring of the other, which allows remote attackers to spoof trusted certificates via a crafted subjectAltName.
| Vendor | Product | Versions |
|---|---|---|
n/a | n/a | affected n/a |
References
[oss-security] 20100309 Re: CVE Request: libesmtp does not check NULL bytes in commonName
mailing-list
x_refsource_MLIST
ADV-2010-1107
vdb-entry
x_refsource_VUPEN
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=311191
x_refsource_CONFIRM
SUSE-SR:2010:011
vendor-advisory
x_refsource_SUSE
[oss-security] 20100303 CVE Request: libesmtp does not check NULL bytes in commonName
mailing-list
x_refsource_MLIST
Security Training
Train your team to recognize and prevent security threats with our comprehensive security awareness program.
Start TrainingVulnerability Scanning
Discover vulnerabilities in your applications and infrastructure before attackers do.
Scan Now