MDVSA-2010:003 -- Mandriva sendmailID: oval:org.secpod.oval:def:300111 | Date: (C)2012-01-07 (M)2024-02-19 |
Class: PATCH | Family: unix |
A security vulnerability has been identified and fixed in sendmail: sendmail before 8.14.4 does not properly handle a "\0" character in a Common Name field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL-based SMTP servers via a crafted server certificate issued by a legitimate Certification Authority, and allows remote attackers to bypass intended access restrictions via a crafted client certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408 . Packages for 2008.0 are provided for Corporate Desktop 2008.0 customers. This update provides a fix for this vulnerability.
Platform: |
Mandriva Linux 2010.0 |
Mandriva Linux 2009.0 |
Mandriva Linux 2009.1 |
Mandriva Linux 2008.0 |