Mandrake Linux Security Advisory : fetchmail (MDKSA-2001:072)

Critical Nessus Plugin ID 13887


The remote Mandrake Linux host is missing one or more security updates.


A vulnerability was found by Salvatore Sanfilippo in both the IMAP and POP3 code of fetchmail where the input is not verified and no bounds checking is done. This can be exploited by a remote attacker to write arbitrary data into memory. The attacker must have control of the mail server the client is connecting to via fetchmail in order to exploit this vulnerability.


Update the affected fetchmail, fetchmail-daemon and / or fetchmailconf packages.

Plugin Details

Severity: Critical

ID: 13887

File Name: mandrake_MDKSA-2001-072.nasl

Version: $Revision: 1.13 $

Type: local

Published: 2004/07/31

Modified: 2013/05/31

Dependencies: 12634

Risk Information

Risk Factor: Critical


Base Score: 10

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Vulnerability Information

CPE: p-cpe:/a:mandriva:linux:fetchmail, p-cpe:/a:mandriva:linux:fetchmail-daemon, p-cpe:/a:mandriva:linux:fetchmailconf, cpe:/o:mandrakesoft:mandrake_linux:7.1, cpe:/o:mandrakesoft:mandrake_linux:7.2, cpe:/o:mandrakesoft:mandrake_linux:8.0

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/Mandrake/release, Host/Mandrake/rpm-list

Patch Publication Date: 2001/08/31

Reference Information

CVE: CVE-2001-1009

MDKSA: 2001:072