The sdump function in sdump.c in fetchmail 6.3.11, 6.3.12, and 6.3.13, when running in verbose mode on platforms for which char is signed, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via an SSL X.509 certificate containing non-printable characters with the high bit set, which triggers a heap-based buffer overflow during escaping.

A vulnerability have been discovered and corrected in fetchmail :

The sdump function in sdump.c in fetchmail 6.3.11, 6.3.12, and 6.3.13, when running in verbose mode on platforms for which char is signed, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via an SSL X.509 certificate containing non-printable characters with the high bit set, which triggers a heap-based buffer overflow during escaping (CVE-2010-0562).

This update provides fetchmail 6.3.14, which is not vulnerable to this issue.

The updated package fixes CVE-2010-0562.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201006-12 (Fetchmail: Multiple vulnerabilities)

    Multiple vulnerabilities have been reported in Fetchmail:
    The sdump() function might trigger a heap-based buffer overflow     during the escaping of non-printable characters with the high bit set     from an X.509 certificate (CVE-2010-0562).
    The vendor reported     that Fetchmail does not properly handle Common Name (CN) fields in     X.509 certificates that contain an ASCII NUL character. Specifically,     the processing of such fields is stopped at the first occurrence of a     NUL character. This type of vulnerability was recently discovered by     Dan Kaminsky and Moxie Marlinspike (CVE-2009-2666).
  Impact :

    A remote attacker could entice a user to connect with Fetchmail to a     specially crafted SSL-enabled server in verbose mode, possibly     resulting in the execution of arbitrary code with the privileges of the     user running the application. NOTE: The issue is only existent on     platforms on which char is signed.
    Furthermore, a remote attacker might employ a specially crafted X.509     certificate, containing a NUL character in the Common Name field to     conduct man-in-the-middle attacks on SSL connections made using     Fetchmail.
  Workaround :

    There is no known workaround at this time.

This update fixes a heap-based overflow in fetchmail's sdump() function. It can be exploited while displaying detailed X.509 certification information to cause a crash or to probably execute arbitrary code too. (CVE-2010-0562: CVSS v2 Base Score: 4.0 (low) (AV:N/AC:H/Au:N/C:N/I:P/A:P): Buffer Errors (CWE-119))

Matthias Andree reports :

In verbose mode, fetchmail prints X.509 certificate subject and issuer information to the user, and counts and allocates a malloc() buffer for that purpose.

If the material to be displayed contains characters with high bit set and the platform treats the 'char' type as signed, this can cause a heap buffer overrun because non-printing characters are escaped as \xFF..FFnn, where nn is 80..FF in hex.

ID	Name	Product	Family	Type	Severity
48173	Mandriva Linux Security Advisory : fetchmail (MDVSA-2010:037)	Nessus	Mandriva Local Security Checks	Local	medium
47329	Fedora 12 : fetchmail-6.3.11-4.fc12 (2010-3800)	Nessus	Fedora Local Security Checks	Local	medium
46779	GLSA-201006-12 : Fetchmail: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	Local	medium
44667	openSUSE Security Update : fetchmail (fetchmail-1996)	Nessus	SuSE Local Security Checks	Local	medium
44600	FreeBSD : fetchmail -- heap overflow on verbose X.509 display (2a6a966f-1774-11df-b5c1-0026189baca3)	Nessus	FreeBSD Local Security Checks	Local	medium

Detections

Analytics

CVE-2010-0562

critical

Tenable Plugins

medium

medium

medium

medium

medium