CVE-2010-1194

Published: Mar 31, 2010Modified: Apr 29, 2026

6.8

Vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability: 8.6 / Impact: 6.4

Source: NVD

Description

The match_component function in smtp-tls.c in libESMTP 1.0.3.r1, and possibly other versions including 1.0.4, treats two strings as equal if one is a substring of the other, which allows remote attackers to spoof trusted certificates via a crafted subjectAltName.

Affected (32)

Products: Stafford.uklinux: Libesmtp

Stafford.uklinux

1 product

Libesmtp

Configuration A

32 vulnerable

Vulnerable Software	Affected Versions
Stafford.uklinux Libesmtp	Version 0.1
Stafford.uklinux Libesmtp	Version 0.1 a
Stafford.uklinux Libesmtp	Version 0.2
Stafford.uklinux Libesmtp	Version 0.3
Stafford.uklinux Libesmtp	Version 0.4
Stafford.uklinux Libesmtp	Version 0.5
Stafford.uklinux Libesmtp	Version 0.6.1
Stafford.uklinux Libesmtp	Version 0.6
Stafford.uklinux Libesmtp	Version 0.6 a
Stafford.uklinux Libesmtp	Version 0.7.0
Stafford.uklinux Libesmtp	Version 0.7.1
Stafford.uklinux Libesmtp	Version 0.8.0
Stafford.uklinux Libesmtp	Version 0.8.10
Stafford.uklinux Libesmtp	Version 0.8.10 p1
Stafford.uklinux Libesmtp	Version 0.8.11
Stafford.uklinux Libesmtp	Version 0.8.12
Stafford.uklinux Libesmtp	Version 0.8.1
Stafford.uklinux Libesmtp	Version 0.8.2
Stafford.uklinux Libesmtp	Version 0.8.3
Stafford.uklinux Libesmtp	Version 0.8.4
Stafford.uklinux Libesmtp	Version 0.8.5
Stafford.uklinux Libesmtp	Version 0.8.6
Stafford.uklinux Libesmtp	Version 0.8.7
Stafford.uklinux Libesmtp	Version 0.8.8
Stafford.uklinux Libesmtp	Version 0.8.9
Stafford.uklinux Libesmtp	Version 1.0.1
Stafford.uklinux Libesmtp	Version 1.0.2
Stafford.uklinux Libesmtp	Version 1.0.3
Stafford.uklinux Libesmtp	Version 1.0.3 r1
Stafford.uklinux Libesmtp	Version 1.0.4
Stafford.uklinux Libesmtp	Version 1.0
Stafford.uklinux Libesmtp	Version 1.0 rc1