FreeBSD : fetchmail -- denial of service/crash from malicious POP3 server (3f4ac724-fa8b-11d9-afcf-0060084a00e5)

High Nessus Plugin ID 19340


The remote FreeBSD host is missing a security-related update.


In fetchmail, the remote code injection via POP3 UIDL was fixed, but a denial of service attack was introduced :

Two possible NULL pointer dereferences allow a malicious POP3 server to crash fetchmail by respondig with UID lines containing only the article number but no UID (in violation of RFC-1939), or a message without Message-ID when no UIDL support is available.


Update the affected package.

See Also

Plugin Details

Severity: High

ID: 19340

File Name: freebsd_pkg_3f4ac724fa8b11d9afcf0060084a00e5.nasl

Version: $Revision: 1.13 $

Type: local

Published: 2005/08/01

Modified: 2017/07/05

Dependencies: 12634

Risk Information

Risk Factor: High

Vulnerability Information

CPE: p-cpe:/a:freebsd:freebsd:fetchmail, cpe:/o:freebsd:freebsd

Required KB Items: Host/local_checks_enabled, Host/FreeBSD/release, Host/FreeBSD/pkg_info

Patch Publication Date: 2005/07/22

Vulnerability Publication Date: 2005/07/21