libESMTP, probably 1.0.4 and earlier, does not properly handle a '\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - libESMTP, probably 1.0.4 and earlier, does not properly handle a '\0' character in a domain name in the     subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to     spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a     related issue to CVE-2009-2408. (CVE-2010-1192)

Note that Nessus relies on the presence of the package as reported by the vendor.

libesmtp did not properly handle wildcards and embedded null characters in the Common Name of X.509 certificates (CVE-2010-1192 / CVE-2010-1194). This has been fixed.

Multiple vulnerabilities has been found and corrected in libesmtp :

libESMTP, probably 1.0.4 and earlier, does not properly handle a \'\0\' (NUL) character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408 (CVE-2010-1192).

The match_component function in smtp-tls.c in libESMTP 1.0.3.r1, and possibly other versions including 1.0.4, treats two strings as equal if one is a substring of the other, which allows remote attackers to spoof trusted certificates via a crafted subjectAltName (CVE-2010-1194).

Packages for 2008.0 and 2009.0 are provided as of the Extended Maintenance Program. Please visit this link to learn more:
http://store.mandriva.com/product_info.php?cPath=149&amp;products_id=4 90

The updated packages have been patched to correct these issues.

libesmtp did not properly handle wildcards and embedded null characters in the Common Name of X.509 certificates (CVE-2010-1192, CVE-2010-1194).

ID	Name	Product	Family	Severity
217145	Linux Distros Unpatched Vulnerability : CVE-2010-1192	Nessus	Misc.	critical
50929	SuSE 11 Security Update : libesmtp (SAT Patch Number 2390)	Nessus	SuSE Local Security Checks	medium
49742	Mandriva Linux Security Advisory : libesmtp (MDVSA-2010:195)	Nessus	Mandriva Local Security Checks	medium
46251	openSUSE Security Update : libesmtp (openSUSE-SU-2010:0220-1)	Nessus	SuSE Local Security Checks	medium
46250	openSUSE Security Update : libesmtp (openSUSE-SU-2010:0220-1)	Nessus	SuSE Local Security Checks	medium
46249	openSUSE Security Update : libesmtp (openSUSE-SU-2010:0220-1)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2010-1192

medium

Tenable Plugins

critical

medium

medium

medium

medium

medium