oss-security - Re: CVE request: fetchmail <= 6.3.10 SSL certificate NUL prefix verification bypass

Openwall Project		/home Owl JtR Pro crypt pam_passwdqc tcb phpass scanlogd popa3d msulogin / Linux BIND / advisories presentations / services donations / wordlists passwords / NEWS community lists Wiki CVSweb mirrors signatures
bringing security into open environments

Password Recovery Resources on the Net

[<prev] [next>] [<thread-prev] [thread-next>] [month] [year] [list]

Date: Thu, 06 Aug 2009 02:19:31 +0200
From: "Matthias Andree" <matthias.andree@....de>
To: oss-security@...ts.openwall.com
Cc: "Steven M. Christey" <coley@...us.mitre.org>
Subject: Re: CVE request: fetchmail <= 6.3.10 SSL certificate
 NUL prefix verification bypass

Am 05.08.2009, 20:13 Uhr, schrieb Steven M. Christey  
<coley@...us.mitre.org>:

> So use CVE-2009-2666 for fetchmail (I'll fill it in later) and Tomas,  
> even if it results in dozens of CVEs, I suspect this is how we should go.

Thank you.

http://www.fetchmail.info/fetchmail-SA-2009-01.txt

-- 
Matthias Andree

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.