Unrated severityNVD Advisory· Published Jan 4, 2010· Updated Apr 23, 2026
CVE-2009-4565
CVE-2009-4565
Description
sendmail before 8.14.4 does not properly handle a '\0' character in a Common Name (CN) field of an X.509 certificate, which (1) allows man-in-the-middle attackers to spoof arbitrary SSL-based SMTP servers via a crafted server certificate issued by a legitimate Certification Authority, and (2) allows remote attackers to bypass intended access restrictions via a crafted client certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.
Affected products
62cpe:2.3:a:sendmail:sendmail:*:*:*:*:*:*:*:*+ 61 more
- cpe:2.3:a:sendmail:sendmail:*:*:*:*:*:*:*:*range: <=8.14.3
- cpe:2.3:a:sendmail:sendmail:2.6:*:*:*:*:*:*:*
- cpe:2.3:a:sendmail:sendmail:2.6.1:*:*:*:*:*:*:*
- cpe:2.3:a:sendmail:sendmail:3.0:*:*:*:*:*:*:*
- cpe:2.3:a:sendmail:sendmail:3.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:sendmail:sendmail:4.1:*:*:*:*:*:*:*
- cpe:2.3:a:sendmail:sendmail:4.55:*:*:*:*:*:*:*
- cpe:2.3:a:sendmail:sendmail:5:*:*:*:*:*:*:*
- cpe:2.3:a:sendmail:sendmail:5.59:*:*:*:*:*:*:*
- cpe:2.3:a:sendmail:sendmail:5.61:*:*:*:*:*:*:*
- cpe:2.3:a:sendmail:sendmail:5.65:*:*:*:*:*:*:*
- cpe:2.3:a:sendmail:sendmail:8.10:*:*:*:*:*:*:*
- cpe:2.3:a:sendmail:sendmail:8.10.0:*:*:*:*:*:*:*
- cpe:2.3:a:sendmail:sendmail:8.10.1:*:*:*:*:*:*:*
- cpe:2.3:a:sendmail:sendmail:8.10.2:*:*:*:*:*:*:*
- cpe:2.3:a:sendmail:sendmail:8.11.0:*:*:*:*:*:*:*
- cpe:2.3:a:sendmail:sendmail:8.11.1:*:*:*:*:*:*:*
- cpe:2.3:a:sendmail:sendmail:8.11.2:*:*:*:*:*:*:*
- cpe:2.3:a:sendmail:sendmail:8.11.3:*:*:*:*:*:*:*
- cpe:2.3:a:sendmail:sendmail:8.11.4:*:*:*:*:*:*:*
- cpe:2.3:a:sendmail:sendmail:8.11.5:*:*:*:*:*:*:*
- cpe:2.3:a:sendmail:sendmail:8.11.6:*:*:*:*:*:*:*
- cpe:2.3:a:sendmail:sendmail:8.11.7:*:*:*:*:*:*:*
- cpe:2.3:a:sendmail:sendmail:8.12.0:*:*:*:*:*:*:*
- cpe:2.3:a:sendmail:sendmail:8.12.1:*:*:*:*:*:*:*
- cpe:2.3:a:sendmail:sendmail:8.12.10:*:*:*:*:*:*:*
- cpe:2.3:a:sendmail:sendmail:8.12.2:*:*:*:*:*:*:*
- cpe:2.3:a:sendmail:sendmail:8.12.3:*:*:*:*:*:*:*
- cpe:2.3:a:sendmail:sendmail:8.12.4:*:*:*:*:*:*:*
- cpe:2.3:a:sendmail:sendmail:8.12.5:*:*:*:*:*:*:*
- cpe:2.3:a:sendmail:sendmail:8.12.6:*:*:*:*:*:*:*
- cpe:2.3:a:sendmail:sendmail:8.12.7:*:*:*:*:*:*:*
- cpe:2.3:a:sendmail:sendmail:8.12.8:*:*:*:*:*:*:*
- cpe:2.3:a:sendmail:sendmail:8.12.9:*:*:*:*:*:*:*
- cpe:2.3:a:sendmail:sendmail:8.12:beta10:*:*:*:*:*:*
- cpe:2.3:a:sendmail:sendmail:8.12:beta12:*:*:*:*:*:*
- cpe:2.3:a:sendmail:sendmail:8.12:beta16:*:*:*:*:*:*
- cpe:2.3:a:sendmail:sendmail:8.12:beta5:*:*:*:*:*:*
- cpe:2.3:a:sendmail:sendmail:8.12:beta7:*:*:*:*:*:*
- cpe:2.3:a:sendmail:sendmail:8.13.0:*:*:*:*:*:*:*
- cpe:2.3:a:sendmail:sendmail:8.13.1:*:*:*:*:*:*:*
- cpe:2.3:a:sendmail:sendmail:8.13.1.2:*:*:*:*:*:*:*
- cpe:2.3:a:sendmail:sendmail:8.13.2:*:*:*:*:*:*:*
- cpe:2.3:a:sendmail:sendmail:8.13.3:*:*:*:*:*:*:*
- cpe:2.3:a:sendmail:sendmail:8.13.4:*:*:*:*:*:*:*
- cpe:2.3:a:sendmail:sendmail:8.13.5:*:*:*:*:*:*:*
- cpe:2.3:a:sendmail:sendmail:8.13.6:*:*:*:*:*:*:*
- cpe:2.3:a:sendmail:sendmail:8.13.7:*:*:*:*:*:*:*
- cpe:2.3:a:sendmail:sendmail:8.13.8:*:*:*:*:*:*:*
- cpe:2.3:a:sendmail:sendmail:8.14.1:*:*:*:*:*:*:*
- cpe:2.3:a:sendmail:sendmail:8.14.2:*:*:*:*:*:*:*
- cpe:2.3:a:sendmail:sendmail:8.6.7:*:*:*:*:*:*:*
- cpe:2.3:a:sendmail:sendmail:8.7.10:*:*:*:*:*:*:*
- cpe:2.3:a:sendmail:sendmail:8.7.6:*:*:*:*:*:*:*
- cpe:2.3:a:sendmail:sendmail:8.7.7:*:*:*:*:*:*:*
- cpe:2.3:a:sendmail:sendmail:8.7.8:*:*:*:*:*:*:*
- cpe:2.3:a:sendmail:sendmail:8.7.9:*:*:*:*:*:*:*
- cpe:2.3:a:sendmail:sendmail:8.8.8:*:*:*:*:*:*:*
- cpe:2.3:a:sendmail:sendmail:8.9.0:*:*:*:*:*:*:*
- cpe:2.3:a:sendmail:sendmail:8.9.1:*:*:*:*:*:*:*
- cpe:2.3:a:sendmail:sendmail:8.9.2:*:*:*:*:*:*:*
- cpe:2.3:a:sendmail:sendmail:8.9.3:*:*:*:*:*:*:*
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
20- www.sendmail.org/releases/8.14.4nvdPatch
- www.vupen.com/english/advisories/2009/3661nvdPatchVendor Advisory
- secunia.com/advisories/37998nvdVendor Advisory
- lists.opensuse.org/opensuse-security-announce/2010-03/msg00004.htmlnvd
- marc.infonvd
- secunia.com/advisories/38314nvd
- secunia.com/advisories/38915nvd
- secunia.com/advisories/39088nvd
- secunia.com/advisories/40109nvd
- secunia.com/advisories/43366nvd
- security.gentoo.org/glsa/glsa-201206-30.xmlnvd
- sunsolve.sun.com/search/document.donvd
- www.debian.org/security/2010/dsa-1985nvd
- www.redhat.com/support/errata/RHSA-2011-0262.htmlnvd
- www.securityfocus.com/bid/37543nvd
- www.vupen.com/english/advisories/2010/0719nvd
- www.vupen.com/english/advisories/2010/1386nvd
- www.vupen.com/english/advisories/2011/0415nvd
- oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10255nvd
- oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11822nvd
News mentions
0No linked articles in our index yet.