FreeBSD : fetchmail -- denial of service/crash from malicious POP3 server (3f4ac724-fa8b-11d9-afcf-0060084a00e5)

high Nessus Plugin ID 19340

Synopsis

The remote FreeBSD host is missing a security-related update.

Description

In fetchmail 6.2.5.1, the remote code injection via POP3 UIDL was fixed, but a denial of service attack was introduced :

Two possible NULL pointer dereferences allow a malicious POP3 server to crash fetchmail by respondig with UID lines containing only the article number but no UID (in violation of RFC-1939), or a message without Message-ID when no UIDL support is available.

Solution

Update the affected package.

Plugin Details

Severity: High

ID: 19340

File Name: freebsd_pkg_3f4ac724fa8b11d9afcf0060084a00e5.nasl

Version: 1.17

Type: Local

Family: FreeBSD Local Security Checks

Published: 8/1/2005

Updated: 1/6/2021

Supported Sensors: Nessus

Vulnerability Information

CPE: cpe:/o:freebsd:freebsd, p-cpe:/a:freebsd:freebsd:fetchmail

Required KB Items: Host/local_checks_enabled, Host/FreeBSD/release, Host/FreeBSD/pkg_info

Patch Publication Date: 7/22/2005

Vulnerability Publication Date: 7/21/2005

Detections

Analytics