Secure testing team - Mar 2010 - Bug#572960: libesmtp does not check NULL bytes in commonNames of certificates

Package: libesmtp
Severity: grave
Tags: security

Kees Cook reported this on the oss-security mailing list:

http://www.openwall.com/lists/oss-security/2010/03/03/6

Cheers,
        Moritz

-- System Information:
Debian Release: squeeze/sid
  APT prefers unstable
  APT policy: (500, ''unstable'')
Architecture: i386 (i686)

Kernel: Linux 2.6.32-2-686 (SMP w/1 CPU core)
Locale: LANG=C, LC_CTYPE=de_DE.ISO-8859-15 at euro (charmap=ISO-8859-15)
Shell: /bin/sh linked to /bin/bash