Fluid Attacks Database

Description

sendmail before 8.14.4 does not properly handle a '\0' character in a Common Name (CN) field of an X.509 certificate, which (1) allows man-in-the-middle attackers to spoof arbitrary SSL-based SMTP servers via a crafted server certificate issued by a legitimate Certification Authority, and (2) allows remote attackers to bypass intended access restrictions via a crafted client certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Package	Affected version	Patched versions
debian 12	sendmail	>=0 <8.14.3-9.1	8.14.3-9.1
debian 11	sendmail	>=0 <8.14.3-9.1	8.14.3-9.1
debian 13	sendmail	>=0 <8.14.3-9.1	8.14.3-9.1
debian 14	sendmail	>=0 <8.14.3-9.1	8.14.3-9.1
rpm rhel5	sendmail	<0:8.13.8-8.el5	0:8.13.8-8.el5

Aliases

1. CVE-2009-45652. NVD-2009-45653. OSV-DEBIAN-2009-45654. OSV-2009-45655. SECURITY-TRACKER-CVE-2009-4565

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.