Mandriva Linux Security Advisory 2010-003 – sendmail before 8.14.4 does not properly handle a ‘ ’ (NUL) character in a Common Name (CN) field of an X.509 certificate, which (1) allows man-in-the-middle attackers to spoof arbitrary SSL-based SMTP servers via a crafted server certificate issued by a legitimate Certification Authority, and (2) allows remote attackers to bypass intended access restrictions via a crafted client certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408. Packages for 2008.0 are provided for Corporate Desktop 2008.0 customers. This update provides a fix for this vulnerability.
You can download this advisory from the following link: https://packetstormsecurity.com/files/download/85033/MDVSA-2010-003.txt
Source: https://packetstormsecurity.com/files/85033/Mandriva-Linux-Security-Advisory-2010-003.html