fetchmail before 6.3.6-rc4 does not properly enforce TLS and may transmit cleartext passwords over unsecured links if certain circumstances occur, which allows remote attackers to obtain sensitive information via man-in-the-middle (MITM) attacks.

From Red Hat Security Advisory 2007:0018 :

Updated fetchmail packages that fix two security issues are now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

Fetchmail is a remote mail retrieval and forwarding utility.

A denial of service flaw was found when Fetchmail was run in multidrop mode. A malicious mail server could send a message without headers which would cause Fetchmail to crash (CVE-2005-4348). This issue did not affect the version of Fetchmail shipped with Red Hat Enterprise Linux 2.1 or 3.

A flaw was found in the way Fetchmail used TLS encryption to connect to remote hosts. Fetchmail provided no way to enforce the use of TLS encryption and would not authenticate POP3 protocol connections properly (CVE-2006-5867). This update corrects this issue by enforcing TLS encryption when the 'sslproto' configuration directive is set to 'tls1'.

Users of Fetchmail should update to these packages, which contain backported patches to correct these issues.

Note: This update may break configurations which assumed that Fetchmail would use plain-text authentication if TLS encryption is not supported by the POP3 server even if the 'sslproto' directive is set to 'tls1'. If you are using a custom configuration that depended on this behavior you will need to modify your configuration appropriately after installing this update.

Three security issues have been fixed in fetchmail :

  - fetchmail when configured for multidrop mode, allows     remote attackers to cause a denial of service     (application crash) by sending messages without headers     from upstream mail servers. (CVE-2005-4348)

  - fetchmail did not properly enforce TLS and may transmit     cleartext passwords over unsecured links if certain     circumstances occur, which allows remote attackers to     obtain sensitive information via man-in-the-middle     (MITM) attacks. (CVE-2006-5867)

  - fetchmail when refusing a message delivered via the mda     option, allowed remote attackers to cause a denial of     service (crash) via unknown vectors that trigger a NULL     pointer dereference when calling the ferror or fflush     functions. (CVE-2006-5974)

It was discovered that fetchmail did not correctly require TLS negotiation in certain situations. This would result in a user's unencrypted password being sent across the network.

If fetchmail has been configured to use the 'sslproto tls1', 'sslcertck', or 'sslfingerprint' options with a server that does not correctly support TLS negotiation, this update may cause fetchmail to (correctly) abort authentication.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Three security issues have been fixed in fetchmail :

CVE-2005-4348: fetchmail when configured for multidrop mode, allows remote attackers to cause a denial of service (application crash) by sending messages without headers from upstream mail servers.

CVE-2006-5867: fetchmail did not properly enforce TLS and may transmit cleartext passwords over unsecured links if certain circumstances occur, which allows remote attackers to obtain sensitive information via man-in-the-middle (MITM) attacks.

CVE-2006-5974: fetchmail when refusing a message delivered via the mda option, allowed remote attackers to cause a denial of service (crash) via unknown vectors that trigger a NULL pointer dereference when calling the ferror or fflush functions.

The remote host is running a version of Mac OS X 10.4 that does not have Security Update 2007-004 applied.

This update fixes security flaws in the following applications :

AFP Client AirPort CarbonCore diskdev_cmds fetchmail ftpd gnutar Help Viewer HID Family Installer Kerberos Libinfo Login Window network_cmds SMB System Configuration URLMount Video Conference WebDAV

New fetchmail packages are available for Slackware 8.1, 9.0, 9.1, 10.0, 10.1, 10.2, and 11.0 to fix a security issue.

Fetchmail before 6.3.6-rc4 does not properly enforce TLS and may transmit cleartext passwords over unsecured links if certain circumstances occur, which allows remote attackers to obtain sensitive information via man-in-the-middle (MITM) attacks.

The updated packages have been patched to correct this problem.

Isaac Wilcox discovered that fetchmail, a popular mail retrieval and forwarding utility, insufficiently enforces encryption of connections, which might lead to information disclosure.

Updated fetchmail packages that fix two security issues are now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

Fetchmail is a remote mail retrieval and forwarding utility.

A denial of service flaw was found when Fetchmail was run in multidrop mode. A malicious mail server could send a message without headers which would cause Fetchmail to crash (CVE-2005-4348). This issue did not affect the version of Fetchmail shipped with Red Hat Enterprise Linux 2.1 or 3.

A flaw was found in the way Fetchmail used TLS encryption to connect to remote hosts. Fetchmail provided no way to enforce the use of TLS encryption and would not authenticate POP3 protocol connections properly (CVE-2006-5867). This update corrects this issue by enforcing TLS encryption when the 'sslproto' configuration directive is set to 'tls1'.

Users of Fetchmail should update to these packages, which contain backported patches to correct these issues.

Note: This update may break configurations which assumed that Fetchmail would use plain-text authentication if TLS encryption is not supported by the POP3 server even if the 'sslproto' directive is set to 'tls1'. If you are using a custom configuration that depended on this behavior you will need to modify your configuration appropriately after installing this update.

The remote host is affected by the vulnerability described in GLSA-200701-13 (Fetchmail: Denial of Service and password disclosure)

    Neil Hoggarth has discovered that when delivering messages to a message     delivery agent by means of the 'mda' option, Fetchmail passes a NULL     pointer to the ferror() and fflush() functions when refusing a message.
    Isaac Wilcox has discovered numerous means of plain-text password     disclosure due to errors in secure connection establishment.
  Impact :

    An attacker could deliver a message via Fetchmail to a message delivery     agent configured to refuse the message, and crash the Fetchmail     process. SMTP and LMTP delivery modes are not affected by this     vulnerability. An attacker could also perform a Man-in-the-Middle     attack, and obtain plain-text authentication credentials of users     connecting to a Fetchmail process.
  Workaround :

    There is no known workaround at this time.

- Sat Jan 6 2007 Miloslav Trmac <mitr at redhat.com> -     6.3.6-1

    - Update to fetchmail-6.3.6 (CVE-2006-5867,       CVE-2006-5974)

    - Wed Nov 1 2006 Miloslav Trmac <mitr at redhat.com> -       6.3.5-1

    - Update to fetchmail-6.3.5

    - Fix some rpmlint warnings

    - Sun Sep 24 2006 Miloslav Trmac <mitr at redhat.com> -       6.3.4-2

    - Don't increase the certificate search path on each       poll (#206346)

    - Wed Jul 12 2006 Jesse Keating <jkeating at redhat.com>
      - 6.3.4-1.1

    - rebuild

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Matthias Andree reports :

Fetchmail has had several longstanding password disclosure vulnerabilities.

- sslcertck/sslfingerprint options should have implied 'sslproto tls1' in order to enforce TLS negotiation, but did not.

- Even with 'sslproto tls1' in the config, fetches would go ahead in plain text if STLS/STARTTLS wasn't available (not advertised, or advertised but rejected).

- POP3 fetches could completely ignore all TLS options whether available or not because it didn't reliably issue CAPA before checking for STLS support - but CAPA is a requisite for STLS. Whether or not CAPAbilities were probed, depended on the 'auth' option. (Fetchmail only tried CAPA if the auth option was not set at all, was set to gssapi, kerberos, kerberos_v4, otp, or cram-md5.)

- POP3 could fall back to using plain text passwords, even if strong authentication had been configured.

- POP2 would not complain if strong authentication or TLS had been requested.

ID	Name	Product	Family	Severity
67440	Oracle Linux 3 / 4 : fetchmail (ELSA-2007-0018)	Nessus	Oracle Linux Local Security Checks	high
29425	SuSE 10 Security Update : fetchmail (ZYPP Patch Number 2608)	Nessus	SuSE Local Security Checks	high
27993	Ubuntu 5.10 / 6.06 LTS / 6.10 : fetchmail vulnerability (USN-405-1)	Nessus	Ubuntu Local Security Checks	high
27213	openSUSE 10 Security Update : fetchmail (fetchmail-2602)	Nessus	SuSE Local Security Checks	high
25081	Mac OS X Multiple Vulnerabilities (Security Update 2007-004)	Nessus	MacOS X Local Security Checks	critical
24666	Slackware 10.0 / 10.1 / 10.2 / 11.0 / 8.1 / 9.0 / 9.1 : fetchmail (SSA:2007-024-01)	Nessus	Slackware Local Security Checks	high
24631	Mandrake Linux Security Advisory : fetchmail (MDKSA-2007:016)	Nessus	Mandriva Local Security Checks	high
24346	Debian DSA-1259-1 : fetchmail - programming error	Nessus	Debian Local Security Checks	high
24316	RHEL 2.1 / 3 / 4 : fetchmail (RHSA-2007:0018)	Nessus	Red Hat Local Security Checks	high
24286	CentOS 3 / 4 : fetchmail (CESA-2007:0018)	Nessus	CentOS Local Security Checks	high
24249	GLSA-200701-13 : Fetchmail: Denial of Service and password disclosure	Nessus	Gentoo Local Security Checks	high
24194	Fedora Core 5 : fetchmail-6.3.6-1.fc5 (2007-041)	Nessus	Fedora Local Security Checks	high
23987	FreeBSD : fetchmail -- TLS enforcement problem/MITM attack/password exposure (5238ac45-9d8c-11db-858b-0060084a00e5)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2006-5867

medium

Tenable Plugins

high

high

high

high

critical

high

high

high

high

high

high

high

high