Published: 04/01/2010 Updated: 19/09/2017

CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10

VMScore: 668

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

sendmail prior to 8.14.4 does not properly handle a '\0' character in a Common Name (CN) field of an X.509 certificate, which (1) allows man-in-the-middle malicious users to spoof arbitrary SSL-based SMTP servers via a crafted server certificate issued by a legitimate Certification Authority, and (2) allows remote malicious users to bypass intended access restrictions via a crafted client certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.

Vulnerable Product	Search on Vulmon	Subscribe to Product
sendmail sendmail 8.14.2
sendmail sendmail
sendmail sendmail 8.7.8
sendmail sendmail 8.7.7
sendmail sendmail 8.7.6
sendmail sendmail 8.13.4
sendmail sendmail 8.13.3
sendmail sendmail 8.12
sendmail sendmail 8.12.4
sendmail sendmail 8.12.3
sendmail sendmail 8.12.2
sendmail sendmail 8.11.4
sendmail sendmail 8.11.3
sendmail sendmail 8.10
sendmail sendmail 2.6
sendmail sendmail 5.61
sendmail sendmail 5.65
sendmail sendmail 8.9.3
sendmail sendmail 8.9.2
sendmail sendmail 8.7.10
sendmail sendmail 8.6.7
sendmail sendmail 8.13.2
sendmail sendmail 8.13.1.2
sendmail sendmail 8.12.9
sendmail sendmail 8.12.10
sendmail sendmail 8.12.1
sendmail sendmail 8.11.2
sendmail sendmail 8.11.1
sendmail sendmail 2.6.1
sendmail sendmail 3.0
sendmail sendmail 8.9.1
sendmail sendmail 8.9.0
sendmail sendmail 8.13.8
sendmail sendmail 8.13.7
sendmail sendmail 8.13.1
sendmail sendmail 8.13.0
sendmail sendmail 8.12.8
sendmail sendmail 8.12.7
sendmail sendmail 8.12.0
sendmail sendmail 8.11.7
sendmail sendmail 8.11.0
sendmail sendmail 8.10.2
sendmail sendmail 3.0.1
sendmail sendmail 4.1
sendmail sendmail 8.14.1
sendmail sendmail 8.8.8
sendmail sendmail 8.7.9
sendmail sendmail 8.13.6
sendmail sendmail 8.13.5
sendmail sendmail 8.12.6
sendmail sendmail 8.12.5
sendmail sendmail 8.11.6
sendmail sendmail 8.11.5
sendmail sendmail 8.10.1
sendmail sendmail 8.10.0
sendmail sendmail 5
sendmail sendmail 4.55
sendmail sendmail 5.59

Synopsis Low: sendmail security and bug fix update Type/Severity Security Advisory: Low Topic Updated sendmail packages that fix two security issues and several bugs arenow available for Red Hat Enterprise Linux 5The Red Hat Security Response Team has rated this update as having lowsecurity impact Common ...

Debian Bug report logs - #564581 CVE-2009-4565: does not properly handle a '\0' character in a Common Name (CN) field of an X509 certificate Package: sendmail; Maintainer for sendmail is Debian QA Group <packages@qadebianorg>; Source for sendmail is src:sendmail (PTS, buildd, popcon) Reported by: Giuseppe Iuculano <iuc ...

It was discovered that sendmail, a Mail Transport Agent, does not properly handle a '\0' character in a Common Name (CN) field of an X509 certificate This allows an attacker to spoof arbitrary SSL-based SMTP servers via a crafted server certificate issued by a legitimate Certification Authority, and to bypass intended access restrictions via a cr ...

CWE-310 http://www.securityfocus.com/bid/37543 http://secunia.com/advisories/37998 http://www.vupen.com/english/advisories/2009/3661 http://www.sendmail.org/releases/8.14.4 http://www.debian.org/security/2010/dsa-1985 http://secunia.com/advisories/38314 http://lists.opensuse.org/opensuse-security-announce/2010-03/msg00004.html http://secunia.com/advisories/38915 http://marc.info/?l=bugtraq&m=126953289726317&w=2 http://secunia.com/advisories/39088 http://secunia.com/advisories/40109 http://www.vupen.com/english/advisories/2010/1386 http://sunsolve.sun.com/search/document.do?assetkey=1-77-1021797.1-1 http://www.vupen.com/english/advisories/2010/0719 http://www.redhat.com/support/errata/RHSA-2011-0262.html http://secunia.com/advisories/43366 http://www.vupen.com/english/advisories/2011/0415 http://security.gentoo.org/glsa/glsa-201206-30.xml https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11822 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10255 https://access.redhat.com/errata/RHSA-2010:0237 https://nvd.nist.gov https://www.debian.org/security/./dsa-1985

CVE-2009-4565

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect