CVE-2009-4565 Security feature bypass in n/a
Attackers can bypass SSL certificate validation in Sendmail to spoof servers or bypass access restrictions via crafted certificates.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2009-4565?
CVE-2009-4565 is a high-severity vulnerability in n/a, published on 4 Jan 2010. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
sendmail before 8.14.4 does not properly handle a '\0' character in a Common Name (CN) field of an X.509 certificate, which (1) allows man-in-the-middle attackers to spoof arbitrary SSL-based SMTP servers via a crafted server certificate issued by a legitimate Certification Authority, and (2) allows remote attackers to bypass intended access restrictions via a crafted client certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.
Weakness: CWE-310
Which versions are affected by CVE-2009-4565?
It affects 1 product.
Linux distribution packages (20)
sendmail Red Hat:enterprise_linux:4::as | All versions | 0:8.13.1-6.el4 |
sendmail-cf Red Hat:enterprise_linux:4::as | All versions | 0:8.13.1-6.el4 |
sendmail-debuginfo Red Hat:enterprise_linux:4::as | All versions | 0:8.13.1-6.el4 |
sendmail-devel Red Hat:enterprise_linux:4::as | All versions | 0:8.13.1-6.el4 |
sendmail-doc Red Hat:enterprise_linux:4::as | All versions | 0:8.13.1-6.el4 |
sendmail Red Hat:enterprise_linux:4::desktop | All versions | 0:8.13.1-6.el4 |
sendmail-cf Red Hat:enterprise_linux:4::desktop | All versions | 0:8.13.1-6.el4 |
sendmail-debuginfo Red Hat:enterprise_linux:4::desktop | All versions | 0:8.13.1-6.el4 |
sendmail-devel Red Hat:enterprise_linux:4::desktop | All versions | 0:8.13.1-6.el4 |
sendmail-doc Red Hat:enterprise_linux:4::desktop | All versions | 0:8.13.1-6.el4 |
sendmail Red Hat:enterprise_linux:4::es | All versions | 0:8.13.1-6.el4 |
sendmail-cf Red Hat:enterprise_linux:4::es | All versions | 0:8.13.1-6.el4 |
sendmail-debuginfo Red Hat:enterprise_linux:4::es | All versions | 0:8.13.1-6.el4 |
sendmail-devel Red Hat:enterprise_linux:4::es | All versions | 0:8.13.1-6.el4 |
sendmail-doc Red Hat:enterprise_linux:4::es | All versions | 0:8.13.1-6.el4 |
sendmail Red Hat:enterprise_linux:4::ws | All versions | 0:8.13.1-6.el4 |
sendmail-cf Red Hat:enterprise_linux:4::ws | All versions | 0:8.13.1-6.el4 |
sendmail-debuginfo Red Hat:enterprise_linux:4::ws | All versions | 0:8.13.1-6.el4 |
sendmail-devel Red Hat:enterprise_linux:4::ws | All versions | 0:8.13.1-6.el4 |
sendmail-doc Red Hat:enterprise_linux:4::ws | All versions | 0:8.13.1-6.el4 |
Products include Sendmail Sendmail.
How do I fix CVE-2009-4565?
Upgrade to a fixed version.
Is CVE-2009-4565 being exploited?
There is no known exploitation of CVE-2009-4565 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as DEBIAN-CVE-2009-4565, DSA-1985-1, GHSA-g4p5-56vp-vcg5, RHSA-2011:0262.