FreeBSD : fetchmail -- denial of service/crash from malicious POP3 server (3f4ac724-fa8b-11d9-afcf-0060084a00e5)
High Nessus Plugin ID 19340
SynopsisThe remote FreeBSD host is missing a security-related update.
DescriptionIn fetchmail 22.214.171.124, the remote code injection via POP3 UIDL was fixed, but a denial of service attack was introduced :
Two possible NULL pointer dereferences allow a malicious POP3 server to crash fetchmail by respondig with UID lines containing only the article number but no UID (in violation of RFC-1939), or a message without Message-ID when no UIDL support is available.
SolutionUpdate the affected package.