Mandriva Linux Security Advisory : fetchmail (MDVSA-2011:107)

This script is Copyright (C) 2011-2013 Tenable Network Security, Inc.

Synopsis :

The remote Mandriva Linux host is missing one or more security

Description :

Multiple vulnerabilities were discovered and corrected in fetchmail :

fetchmail 4.6.3 through 6.3.16, when debug mode is enabled, does not
properly handle invalid characters in a multi-character locale, which
allows remote attackers to cause a denial of service (memory
consumption and application crash) via a crafted (1) message header or
(2) POP3 UIDL list (CVE-2010-1167). NOTE: This vulnerability did not
affect Mandriva Linux 2010.2.

fetchmail 5.9.9 through 6.3.19 does not properly limit the wait time
after issuing a (1) STARTTLS or (2) STLS request, which allows remote
servers to cause a denial of service (application hang) by
acknowledging the request but not sending additional packets

Packages for 2009.0 are provided as of the Extended Maintenance
Program. Please visit this link to learn more: products_id=490

The updated packages have been upgraded to the 6.3.20 version which is
not vulnerable to these issues.

See also :

Solution :

Update the affected fetchmail, fetchmail-daemon and / or fetchmailconf

Risk factor :

Medium / CVSS Base Score : 5.0
CVSS Temporal Score : 4.1
Public Exploit Available : true

Family: Mandriva Local Security Checks

Nessus Plugin ID: 54991 ()

Bugtraq ID: 39556

CVE ID: CVE-2010-1167

Ready to Amp Up Your Nessus Experience?

Get Nessus Professional to scan unlimited IPs, run compliance checks & more

Buy Nessus Professional Now