Debian DSA-774-1 : fetchmail - buffer overflow

medium Nessus Plugin ID 19430

Synopsis

The remote Debian host is missing a security-related update.

Description

Edward Shornock discovered a bug in the UIDL handling code of fetchmail, a common POP3, APOP and IMAP mail fetching utility. A malicious POP3 server could exploit this problem and inject arbitrary code that will be executed on the victim host. If fetchmail is running as root, this becomes a root exploit.

Solution

Upgrade the fetchmail package.

The old stable distribution (woody) is not affected by this problem.

For the stable distribution (sarge) this problem has been fixed in version 6.2.5-12sarge1.

Plugin Details

Severity: Medium

ID: 19430

File Name: debian_DSA-774.nasl

Version: 1.20

Type: local

Agent: unix

Family: Debian Local Security Checks

Published: 8/18/2005

Updated: 1/4/2021

Supported Sensors: Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Nessus

Risk Information

VPR

Risk Factor: Low

Score: 3.6

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 3.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P

Vulnerability Information

CPE: p-cpe:/a:debian:debian_linux:fetchmail, cpe:/o:debian:debian_linux:3.1

Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l

Exploit Ease: No known exploits are available

Patch Publication Date: 8/12/2005

Vulnerability Publication Date: 7/20/2005

Reference Information

CVE: CVE-2005-2335

BID: 14349

DSA: 774

Detections

Analytics