This host has libESMTP installed and is prone to multiple vulnerabilities. Vulnerabilities Insight: Multiple flaws are due to: - An error in 'match_component()' function in 'smtp-tls.c' when processing substrings. It treats two strings as equal if one is a substring of the other, which allows attackers to spoof trusted certificates via a crafted subjectAltName. - An error in handling of 'X.509 certificate'. It does not properly handle a '&qt?&qt' character in a domain name in the 'subject&qts Common Name' field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate.

Attackers can exploit this issue to conduct man-in-the-middle attacks to spoof arbitrary SSL servers and to spoof trusted certificates. Impact Level: Application

Apply patch from below links, https://bugzilla.redhat.com/attachment.cgi?id=399131&action=edit https://bugzilla.redhat.com/attachment.cgi?id=398839&action=edit ***** NOTE: Ignore this warning, if above mentioned patch is manually applied. *****

libESMTP version 1.0.4 and prior.

• http://www.openwall.com/lists/oss-security/2010/03/03/6
• http://www.openwall.com/lists/oss-security/2010/03/09/3
• https://bugzilla.redhat.com/show_bug.cgi?id=571817

---

Updated on 2015-03-25