Buffer overflow in the POP3 client in Fetchmail before 6.2.5.2 allows remote POP3 servers to cause a denial of service and possibly execute arbitrary code via long UIDL responses. NOTE: a typo in an advisory accidentally used the wrong CVE identifier for the Fetchmail issue. This is the correct identifier.

The remote host is running Apple Mac OS X, but lacks Security Update 2006-004.

This security update contains fixes for the following applications :

AFP Server Bluetooth Bom DHCP dyld fetchmail gnuzip ImageIO LaunchServices OpenSSH telnet WebKit

Updated fetchmail packages that fix a security flaw are now available.

This update has been rated as having important security impact by the Red Hat Security Response Team.

Fetchmail is a remote mail retrieval and forwarding utility.

A buffer overflow was discovered in fetchmail's POP3 client. A malicious server could cause send a carefully crafted message UID and cause fetchmail to crash or potentially execute arbitrary code as the user running fetchmail. The Common Vulnerabilities and Exposures project assigned the name CVE-2005-2335 to this issue.

Users of fetchmail should update to this erratum package which contains a backported patch to correct this issue.

Ross Boylan discovered a remote buffer overflow in fetchmail. By sending invalid responses with very long UIDs, a faulty or malicious POP server could crash fetchmail or execute arbitrary code with the privileges of the user invoking fetchmail.

fetchmail is commonly run as root to fetch mail for multiple user accounts; in this case, this vulnerability could be exploited to compromise the whole system.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Thomas Wolff and Miloslav Trmac discovered a race condition in the fetchmailconf program. fetchmailconf would create the initial output configuration file with insecure permissions and only after writing would it change permissions to be more restrictive. During that time, passwords and other data could be exposed to other users on the system unless the user used a more restrictive umask setting.

As well, the Mandriva Linux 2006 packages did not contain the patch that corrected the issues fixed in MDKSA-2005:126, namely a buffer overflow in fetchmail's POP3 client (CVE-2005-2355).

The updated packages have been patched to address this issue, and the Mandriva 2006 packages have also been patched to correct CVE-2005-2355.

A buffer overflow was discovered in fetchmail's POP3 client which could allow a malicious server to send a carefully crafted message UID, causing fetchmail to crash or potentially execute arbitrary code as the user running fetchmail.

The updated packages have been patched to address this problem.

Edward Shornock discovered a bug in the UIDL handling code of fetchmail, a common POP3, APOP and IMAP mail fetching utility. A malicious POP3 server could exploit this problem and inject arbitrary code that will be executed on the victim host. If fetchmail is running as root, this becomes a root exploit.

fetchmail's POP3/UIDL code does not truncate received UIDs properly. A malicious or compromised POP3 server can thus corrupt fetchmail's stack and inject code when fetchmail is using UIDL, either through configuration, or as a result of certain server capabilities. Note that fetchmail is run as root on some sites, so an attack might compromise the root account and thus the whole machine.

The remote host is affected by the vulnerability described in GLSA-200507-21 (fetchmail: Buffer Overflow)

    fetchmail does not properly validate UIDs coming from a POP3 mail     server. The UID is placed in a fixed length buffer on the stack, which     can be overflown.
  Impact :

    Very long UIDs returned from a malicious or compromised POP3     server can cause fetchmail to crash, resulting in a Denial of Service,     or allow arbitrary code to be placed on the stack.
  Workaround :

    There are no known workarounds at this time.

The remote Redhat Enterprise Linux 4 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2005:640 advisory.

    Fetchmail is a remote mail retrieval and forwarding utility.

    A buffer overflow was discovered in fetchmail's POP3 client.  A malicious     server could cause send a carefully crafted message UID and cause fetchmail     to crash or potentially execute arbitrary code as the user running     fetchmail.  The Common Vulnerabilities and Exposures project assigned the     name CAN-2005-2335 to this issue.

    Users of fetchmail should update to this erratum package which contains a     backported patch to correct this issue.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

A buffer overflow was discovered in fetchmail's POP3 client. A malicious server could cause fetchmail to execute arbitrary code.

The Common Vulnerabilities and Exposures project has assigned the name CVE-2005-2355 to this issue.

All fetchmail users should upgrade to the updated package, which fixes this issue.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
22125	Mac OS X Multiple Vulnerabilities (Security Update 2006-004)	Nessus	MacOS X Local Security Checks	critical
21847	CentOS 3 / 4 : fetchmail (CESA-2005:640)	Nessus	CentOS Local Security Checks	medium
20554	Ubuntu 4.10 / 5.04 : fetchmail vulnerability (USN-153-1)	Nessus	Ubuntu Local Security Checks	medium
20442	Mandrake Linux Security Advisory : fetchmail (MDKSA-2005:209)	Nessus	Mandriva Local Security Checks	medium
19887	Mandrake Linux Security Advisory : fetchmail (MDKSA-2005:126)	Nessus	Mandriva Local Security Checks	medium
19430	Debian DSA-774-1 : fetchmail - buffer overflow	Nessus	Debian Local Security Checks	medium
19339	FreeBSD : fetchmail -- remote root/code injection from malicious POP3 server (3497d7be-2fef-45f4-8162-9063751b573a)	Nessus	FreeBSD Local Security Checks	medium
19323	GLSA-200507-21 : fetchmail: Buffer Overflow	Nessus	Gentoo Local Security Checks	medium
19297	RHEL 4 : fetchmail (RHSA-2005:640)	Nessus	Red Hat Local Security Checks	critical
19272	Fedora Core 3 : fetchmail-6.2.5-7.fc3.1 (2005-614)	Nessus	Fedora Local Security Checks	medium
19271	Fedora Core 4 : fetchmail-6.2.5-7.fc4.1 (2005-613)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2005-2335

critical

Tenable Plugins

critical

medium

medium

medium

medium

medium

medium

medium

critical

medium

medium