Heap-based buffer overflow in Fetchmail 6.1.3 and earlier does not account for the "@" character when determining buffer lengths for local addresses, which allows remote attackers to execute arbitrary code via a header with a large number of local addresses.

Stefan Esser of e-matters discovered a buffer overflow in fetchmail, an SSL enabled POP3, APOP and IMAP mail gatherer/forwarder. When fetchmail retrieves a mail all headers that contain addresses are searched for local addresses. If a hostname is missing, fetchmail appends it but doesn't reserve enough space for it. This heap overflow can be used by remote attackers to crash it or to execute arbitrary code with the privileges of the user running fetchmail.

A vulnerability was discovered in all versions of fetchmail prior to 6.2.0 that allows a remote attacker to crash fetchmail and potentially execute arbitrary code by sending carefully crafted email wihch is then parsed by fetchmail. The vulnerability has been fixed in these patched packages of fetchmail.

The remote host is missing the patch for the advisory SUSE-SA:2003:001 (fetchmail).


fetchmail is used to download emails from POP-, IMAP-, ETRN- or ODMR- servers.
Stefan Esser of e-matters reported a bug in fetchmail's mail address expanding code which can lead to remote system compromise.
When fetchmail expands email addresses in mail headers it doesn not allocated enough memory. An attacker can send a malicious formatted mail header to exhaust the memory allocated by fetchmail to overwrite parts of the heap. This can be exploited to execute arbitrary code.

There is no temporary fix known. Please install the new packages from our FTP servers.

Please download the update package for your distribution and verify its integrity by the methods listed in section 3) of this announcement.
Then, install the package using the command 'rpm -Fhv file.rpm' to apply the update.

Updated Fetchmail packages are available for Red Hat Linux Advanced Server which close a remotely-exploitable vulnerability in unpatched versions of Fetchmail prior to 6.2.0.

[Updated 06 Feb 2003] Added fixed packages for Advanced Workstation

Fetchmail is a remote mail retrieval and forwarding utility intended for use over on-demand TCP/IP links such as SLIP and PPP connections.
A bug has been found in the header parsing code in versions of Fetchmail prior to 6.2.0.

The bug allows a remote attacker to crash Fetchmail and potentially execute arbitrary code by sending a carefully crafted email which is parsed by Fetchmail.

All users of Fetchmail are advised to upgrade to the errata packages containing a backported fix which corrects this issue.

ID	Name	Product	Family	Severity
15053	Debian DSA-216-1 : fetchmail - buffer overflow	Nessus	Debian Local Security Checks	high
13996	Mandrake Linux Security Advisory : fetchmail (MDKSA-2003:011)	Nessus	Mandriva Local Security Checks	high
13775	SUSE-SA:2003:001: fetchmail	Nessus	SuSE Local Security Checks	high
12342	RHEL 2.1 : fetchmail (RHSA-2002:294)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2002-1365

high

Tenable Plugins

high

high

high

high