Mandrake Linux Security Advisory : fetchmail (MDKSA-2002:036)

Medium Nessus Plugin ID 13941


The remote Mandrake Linux host is missing one or more security updates.


A problem was discovered with versions of fetchmail prior to 5.9.10 that was triggered by retreiving mail from an IMAP server. The fetchmail client will allocate an array to store the sizes of the messages it is attempting to retrieve. This array size is determined by the number of messages the server is claiming to have, and fetchmail would not check whether or not the number of messages the server was claiming was too high. This would allow a malicious server to make the fetchmail process write data outside of the array bounds.


Update the affected fetchmail, fetchmail-daemon and / or fetchmailconf packages.

See Also

Plugin Details

Severity: Medium

ID: 13941

File Name: mandrake_MDKSA-2002-036.nasl

Version: $Revision: 1.18 $

Type: local

Published: 2004/07/31

Modified: 2013/08/09

Dependencies: 12634

Risk Information

Risk Factor: Medium


Base Score: 5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N

Vulnerability Information

CPE: p-cpe:/a:mandriva:linux:fetchmail, p-cpe:/a:mandriva:linux:fetchmail-daemon, p-cpe:/a:mandriva:linux:fetchmailconf, cpe:/o:mandrakesoft:mandrake_linux:7.1, cpe:/o:mandrakesoft:mandrake_linux:7.2, cpe:/o:mandrakesoft:mandrake_linux:8.0, cpe:/o:mandrakesoft:mandrake_linux:8.1, cpe:/o:mandrakesoft:mandrake_linux:8.2

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/Mandrake/release, Host/Mandrake/rpm-list

Patch Publication Date: 2002/05/28

Reference Information

CVE: CVE-2002-0146

MDKSA: 2002:036