1 -----BEGIN PGP SIGNED MESSAGE-----
4 fetchmail-SA-2009-01: Improper SSL certificate subject verification
6 Topics: Improper SSL certificate subject verification
8 Author: Matthias Andree
11 Type: Allows undetected Man-in-the-middle attacks against SSL/TLS.
12 Impact: Credential disclose to eavesdroppers.
14 CVSSv2 vectors: (AV:N/AC:M/Au:N/C:P/I:N/A:N) (E:H/RL:OF/RC:C)
16 CVE Name: CVE-2009-2666
17 URL: http://www.fetchmail.info/fetchmail-SA-2009-01.txt
18 Project URL: http://www.fetchmail.info/
20 Affects: fetchmail releases up to and including 6.3.10
22 Not affected: fetchmail release 6.3.11 and newer
24 Corrected: 2009-08-04 fetchmail SVN (rev 5389)
26 References: "Null Prefix Attacks Against SSL/TLS Certificates",
27 Moxie Marlinspike, 2009-07-29, Defcon 17, Blackhat 09.
29 CVE-2009-2408, Mozilla Firefox <3.5 and NSS <3.12.3
30 improper handling of '\0' characters in domain names in
31 the Subject CN field of X.509 certificates.
37 2009-08-05 0.1 first draft (visible in SVN)
38 2009-08-06 1.0 first release
44 fetchmail is a software package to retrieve mail from remote POP2, POP3,
45 IMAP, ETRN or ODMR servers and forward it to local SMTP, LMTP servers or
46 message delivery agents. It supports SSL and TLS security layers through
47 the OpenSSL library, if enabled at compile time and if also enabled at
51 2. Problem description and Impact
52 =================================
54 Moxie Marlinspike demonstrated in July 2009 that some CAs would sign
55 certificates that contain embedded NUL characters in the Common Name or
56 subjectAltName fields of ITU-T X.509 certificates.
58 Applications that would treat such X.509 strings as NUL-terminated C
59 strings (rather than strings that contain an explicit length field)
60 would only check the part up to and excluding the NUL character, so that
61 certificate names such as www.good.example\0www.bad.example.com would be
62 mistaken as a certificate name for www.good.example. fetchmail also had
63 this design and implementation flaw.
65 Note that fetchmail should always be forced to use strict certificate
66 validation through either of these option combinations:
68 --sslcertck --ssl --sslproto ssl3 (for service on SSL-wrapped ports)
70 --sslcertck --sslproto tls1 (for STARTTLS-based services)
72 (These are for the command line, in the rcfile, you will need to omit
73 the respective leading --).
75 The default is relaxed checking for compatibility with historic versions.
81 There are two alternatives, either of them by itself is sufficient:
83 a. Apply the patch found in section B of this announcement to
84 fetchmail 6.3.10, recompile and reinstall it.
86 b. Install fetchmail 6.3.11 or newer after it will have become available.
87 The fetchmail source code is always available from
88 <http://developer.berlios.de/project/showfiles.php?group_id=1824>.
94 Obtain the server fingerprints through a separate secure channel and
95 configure them with the sslfingerprint option, and enable the sslcertck
99 A. Copyright, License and Warranty
100 ==================================
102 (C) Copyright 2009 by Matthias Andree, <matthias.andree@gmx.de>.
103 Some rights reserved.
105 This work is licensed under the Creative Commons
106 Attribution-Noncommercial-No Derivative Works 3.0 Germany License.
107 To view a copy of this license, visit
108 http://creativecommons.org/licenses/by-nc-nd/3.0/de/ or send a letter to
113 SAN FRANCISCO, CALIFORNIA 94105
117 THIS WORK IS PROVIDED FREE OF CHARGE AND WITHOUT ANY WARRANTIES.
118 Use the information herein at your own risk.
121 B. Patch to remedy the problem
122 ==============================
124 Note that when taking this from a GnuPG clearsigned file, the lines
125 starting with a "-" character are prefixed by another "- " (dash +
126 blank) combination. Either feed this file through GnuPG to strip them,
127 or strip them manually.
129 Whitespace differences can usually be ignored by invoking "patch -l",
130 so try this if the patch does not apply.
134 ===================================================================
138 report(stderr, GT_("Bad certificate: Subject CommonName too long!\n"));
141 + if ((size_t)i > strlen(buf)) {
142 + /* Name contains embedded NUL characters, so we complain. This is likely
143 + * a certificate spoofing attack. */
144 + report(stderr, GT_("Bad certificate: Subject CommonName contains NUL, aborting!\n"));
147 if (_ssl_server_cname != NULL) {
149 char *p2 = _ssl_server_cname;
150 @@ -643,11 +649,18 @@
151 * first find a match among alternative names */
152 gens = (STACK_OF(GENERAL_NAME) *)X509_get_ext_d2i(x509_cert, NID_subject_alt_name, NULL, NULL);
155 - - for (i = 0, r = sk_GENERAL_NAME_num(gens); i < r; ++i) {
156 - - const GENERAL_NAME *gn = sk_GENERAL_NAME_value(gens, i);
158 + for (j = 0, r = sk_GENERAL_NAME_num(gens); j < r; ++j) {
159 + const GENERAL_NAME *gn = sk_GENERAL_NAME_value(gens, j);
160 if (gn->type == GEN_DNS) {
161 char *p1 = (char *)gn->d.ia5->data;
162 char *p2 = _ssl_server_cname;
163 + /* Name contains embedded NUL characters, so we complain. This
164 + * is likely a certificate spoofing attack. */
165 + if ((size_t)gn->d.ia5->length != strlen(p1)) {
166 + report(stderr, GT_("Bad certificate: Subject Alternative Name contains NUL, aborting!\n"));
167 + sk_GENERAL_NAME_free(gens);
170 if (outlevel >= O_VERBOSE)
171 report(stderr, "Subject Alternative Name: %s\n", p1);
173 END OF fetchmail-SA-2009-01.txt
174 -----BEGIN PGP SIGNATURE-----
175 Version: GnuPG v2.0.9 (GNU/Linux)
177 iEYEARECAAYFAkp6GP8ACgkQvmGDOQUufZVuQwCgsD/kO/+KHC0/gopx/uiQr9V7
178 mXAAnjH6G5DfcxAjCzjmt9DKZHGsqoNv
180 -----END PGP SIGNATURE-----