FreeBSD : fetchmail -- heap overflow on verbose X.509 display (2a6a966f-1774-11df-b5c1-0026189baca3)

Medium Nessus Plugin ID 44600


The remote FreeBSD host is missing a security-related update.


Matthias Andree reports :

In verbose mode, fetchmail prints X.509 certificate subject and issuer information to the user, and counts and allocates a malloc() buffer for that purpose.

If the material to be displayed contains characters with high bit set and the platform treats the 'char' type as signed, this can cause a heap buffer overrun because non-printing characters are escaped as \xFF..FFnn, where nn is 80..FF in hex.


Update the affected package.

See Also

Plugin Details

Severity: Medium

ID: 44600

File Name: freebsd_pkg_2a6a966f177411dfb5c10026189baca3.nasl

Version: $Revision: 1.8 $

Type: local

Published: 2010/02/15

Modified: 2016/05/09

Dependencies: 12634

Risk Information

Risk Factor: Medium


Base Score: 6.8

Temporal Score: 5.9

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P

Temporal Vector: CVSS2#E:ND/RL:OF/RC:C

Vulnerability Information

CPE: p-cpe:/a:freebsd:freebsd:fetchmail, cpe:/o:freebsd:freebsd

Required KB Items: Host/local_checks_enabled, Host/FreeBSD/release, Host/FreeBSD/pkg_info

Exploit Available: false

Exploit Ease: No known exploits are available

Patch Publication Date: 2010/02/12

Vulnerability Publication Date: 2010/02/04

Reference Information

CVE: CVE-2010-0562

BID: 38088

CWE: 119