Edward Shornock discovered a bug in the UIDL handling code of fetchmail, a common POP3, APOP and IMAP mail fetching utility. A malicious POP3 server could exploit this problem and inject arbitrary code that will be executed on the victim host. If fetchmail is running as root, this becomes a root exploit.

A buffer overflow was discovered in fetchmail's POP3 client which could allow a malicious server to send a carefully crafted message UID, causing fetchmail to crash or potentially execute arbitrary code as the user running fetchmail.

The updated packages have been patched to address this problem.

Thomas Wolff and Miloslav Trmac discovered a race condition in the fetchmailconf program. fetchmailconf would create the initial output configuration file with insecure permissions and only after writing would it change permissions to be more restrictive. During that time, passwords and other data could be exposed to other users on the system unless the user used a more restrictive umask setting.

As well, the Mandriva Linux 2006 packages did not contain the patch that corrected the issues fixed in MDKSA-2005:126, namely a buffer overflow in fetchmail's POP3 client (CVE-2005-2355).

The updated packages have been patched to address this issue, and the Mandriva 2006 packages have also been patched to correct CVE-2005-2355.

fetchmail's POP3/UIDL code does not truncate received UIDs properly. A malicious or compromised POP3 server can thus corrupt fetchmail's stack and inject code when fetchmail is using UIDL, either through configuration, or as a result of certain server capabilities. Note that fetchmail is run as root on some sites, so an attack might compromise the root account and thus the whole machine.

Ross Boylan discovered a remote buffer overflow in fetchmail. By sending invalid responses with very long UIDs, a faulty or malicious POP server could crash fetchmail or execute arbitrary code with the privileges of the user invoking fetchmail.

fetchmail is commonly run as root to fetch mail for multiple user accounts; in this case, this vulnerability could be exploited to compromise the whole system.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is running Apple Mac OS X, but lacks Security Update 2006-004.

This security update contains fixes for the following applications :

AFP Server Bluetooth Bom DHCP dyld fetchmail gnuzip ImageIO LaunchServices OpenSSH telnet WebKit

A buffer overflow was discovered in fetchmail's POP3 client. A malicious server could cause fetchmail to execute arbitrary code.

The Common Vulnerabilities and Exposures project has assigned the name CVE-2005-2355 to this issue.

All fetchmail users should upgrade to the updated package, which fixes this issue.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated fetchmail packages that fix a security flaw are now available.

This update has been rated as having important security impact by the Red Hat Security Response Team.

Fetchmail is a remote mail retrieval and forwarding utility.

A buffer overflow was discovered in fetchmail's POP3 client. A malicious server could cause send a carefully crafted message UID and cause fetchmail to crash or potentially execute arbitrary code as the user running fetchmail. The Common Vulnerabilities and Exposures project assigned the name CVE-2005-2335 to this issue.

Users of fetchmail should update to this erratum package which contains a backported patch to correct this issue.

The remote host is affected by the vulnerability described in GLSA-200507-21 (fetchmail: Buffer Overflow)

    fetchmail does not properly validate UIDs coming from a POP3 mail     server. The UID is placed in a fixed length buffer on the stack, which     can be overflown.
  Impact :

    Very long UIDs returned from a malicious or compromised POP3     server can cause fetchmail to crash, resulting in a Denial of Service,     or allow arbitrary code to be placed on the stack.
  Workaround :

    There are no known workarounds at this time.

ID	Name	Product	Family	Published	Updated	Severity
19430	Debian DSA-774-1 : fetchmail - buffer overflow	Nessus	Debian Local Security Checks	8/18/2005	1/4/2021	medium
19887	Mandrake Linux Security Advisory : fetchmail (MDKSA-2005:126)	Nessus	Mandriva Local Security Checks	10/5/2005	1/6/2021	medium
20442	Mandrake Linux Security Advisory : fetchmail (MDKSA-2005:209)	Nessus	Mandriva Local Security Checks	1/15/2006	1/6/2021	medium
19339	FreeBSD : fetchmail -- remote root/code injection from malicious POP3 server (3497d7be-2fef-45f4-8162-9063751b573a)	Nessus	FreeBSD Local Security Checks	8/1/2005	1/6/2021	medium
20554	Ubuntu 4.10 / 5.04 : fetchmail vulnerability (USN-153-1)	Nessus	Ubuntu Local Security Checks	1/15/2006	1/19/2021	medium
22125	Mac OS X Multiple Vulnerabilities (Security Update 2006-004)	Nessus	MacOS X Local Security Checks	8/1/2006	7/14/2018	critical
19271	Fedora Core 4 : fetchmail-6.2.5-7.fc4.1 (2005-613)	Nessus	Fedora Local Security Checks	7/22/2005	1/11/2021	medium
19272	Fedora Core 3 : fetchmail-6.2.5-7.fc3.1 (2005-614)	Nessus	Fedora Local Security Checks	7/22/2005	1/11/2021	medium
19297	RHEL 2.1 / 3 / 4 : fetchmail (RHSA-2005:640)	Nessus	Red Hat Local Security Checks	7/25/2005	1/14/2021	medium
19323	GLSA-200507-21 : fetchmail: Buffer Overflow	Nessus	Gentoo Local Security Checks	7/31/2005	1/6/2021	medium
21847	CentOS 3 / 4 : fetchmail (CESA-2005:640)	Nessus	CentOS Local Security Checks	7/3/2006	1/4/2021	medium

Detections

Analytics

Plugins Search

medium

medium

medium

medium

medium

critical

medium

medium

medium

medium

medium