Debian DSA-774-1 : fetchmail - buffer overflow

Medium Nessus Plugin ID 19430

Synopsis

The remote Debian host is missing a security-related update.

Description

Edward Shornock discovered a bug in the UIDL handling code of fetchmail, a common POP3, APOP and IMAP mail fetching utility. A malicious POP3 server could exploit this problem and inject arbitrary code that will be executed on the victim host. If fetchmail is running as root, this becomes a root exploit.

Solution

Upgrade the fetchmail package.

The old stable distribution (woody) is not affected by this problem.

For the stable distribution (sarge) this problem has been fixed in version 6.2.5-12sarge1.

See Also

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=212762

http://www.debian.org/security/2005/dsa-774

Plugin Details

Severity: Medium

ID: 19430

File Name: debian_DSA-774.nasl

Version: 1.19

Type: local

Agent: unix

Published: 2005/08/18

Updated: 2019/08/02

Dependencies: 12634

Risk Information

Risk Factor: Medium

CVSS v2.0

Base Score: 5

Temporal Score: 3.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P

Temporal Vector: CVSS2#E:U/RL:OF/RC:C

Vulnerability Information

CPE: p-cpe:/a:debian:debian_linux:fetchmail, cpe:/o:debian:debian_linux:3.1

Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l

Exploit Available: false

Exploit Ease: No known exploits are available

Patch Publication Date: 2005/08/12

Vulnerability Publication Date: 2005/07/20

Reference Information

CVE: CVE-2005-2335

BID: 14349

DSA: 774