Mandriva Linux Security Advisory : sendmail (MDVSA-2010:003)
High Nessus Plugin ID 43867
SynopsisThe remote Mandriva Linux host is missing one or more security updates.
DescriptionA security vulnerability has been identified and fixed in sendmail :
sendmail before 8.14.4 does not properly handle a '\0' (NUL) character in a Common Name (CN) field of an X.509 certificate, which (1) allows man-in-the-middle attackers to spoof arbitrary SSL-based SMTP servers via a crafted server certificate issued by a legitimate Certification Authority, and (2) allows remote attackers to bypass intended access restrictions via a crafted client certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408 (CVE-2009-4565).
Packages for 2008.0 are provided for Corporate Desktop 2008.0 customers.
This update provides a fix for this vulnerability.
SolutionUpdate the affected packages.