oss-security - Re: CVE request: fetchmail <= 6.3.10 SSL certificate NUL prefix verification bypass

Openwall Project		/home Owl JtR Pro crypt pam_passwdqc tcb phpass scanlogd popa3d msulogin / Linux BIND / advisories presentations / services donations / wordlists passwords / NEWS community lists Wiki CVSweb mirrors signatures
bringing security into open environments

Password Recovery Resources on the Net

[<prev] [next>] [<thread-prev] [thread-next>] [month] [year] [list]

Date: Wed, 5 Aug 2009 22:05:15 +0200
From: Tomas Hoger <thoger@...hat.com>
To: matthias.andree@....de
Cc: oss-security@...ts.openwall.com,
        "Steven M. Christey"
 <coley@...us.mitre.org>
Subject: Re: CVE request: fetchmail <= 6.3.10 SSL certificate
 NUL prefix verification bypass

Hi Matthias!

On Wed, 05 Aug 2009 18:55:39 +0200 "Matthias Andree"
<matthias.andree@....de> wrote:

> FWIW, I haven't yet tested if this works for NUL in subjectAltNames,
> as I currently don't know how to generate such a certificate (can be  
> self-signed) without writing major amounts of code.
> 
> If someone has a certificate that has embedded NULs in
> subjectAltNames that I can use for testing, please send it along
> together with its key so that I can check the fix also works in that
> code path.

I managed to build these, that may be helpful during the testing:

  http://people.redhat.com/thoger/certs-with-nuls/

Let me know if anything needed is missing there.

HTH

-- 
Tomas Hoger / Red Hat Security Response Team

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.