fetchmailconf before 1.49 in fetchmail 6.2.0, 6.2.5 and 6.2.5.2 creates configuration files with insecure world-readable permissions, which allows local users to obtain sensitive information such as passwords.

Due to restrictive dependency definition for fetchmail-ssl the updated fetchmailconf package couldn't be installed on the old stable distribution (woody) together with fetchmail-ssl.  Hence, this update loosens it, so that the update can be pulled in.  For completeness we're including the original advisory text :

  Thomas Wolff discovered that the fetchmailconf program which is   provided as part of fetchmail, an SSL enabled POP3, APOP, IMAP mail   gatherer/forwarder, creates the new configuration in an insecure   fashion that can lead to leaking passwords for mail accounts to   local users.

This update also fixes a regression in the package for stable caused by the last security update.

The remote host is running Apple Mac OS X, but lacks Security Update 2006-004.

This security update contains fixes for the following applications :

AFP Server Bluetooth Bom DHCP dyld fetchmail gnuzip ImageIO LaunchServices OpenSSH telnet WebKit

The fetchmail team reports :

The fetchmailconf program before and excluding version 1.49 opened the run control file, wrote the configuration to it, and only then changed the mode to 0600 (rw-------). Writing the file, which usually contains passwords, before making it unreadable to other users, can expose sensitive password information.

New fetchmail packages are available for Slackware 8.1, 9.0, 9.1, 10.0, 10.1, 10.2, and -current to fix security issues.

Thomas Wolff and Miloslav Trmac discovered a race condition in the fetchmailconf program. The output configuration file was initially created with insecure permissions, and secure permissions were applied after writing the configuration into the file. During this time, the file was world readable on a standard system (unless the user manually tightened his umask setting), which could expose email passwords to local users.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Thomas Wolff and Miloslav Trmac discovered a race condition in the fetchmailconf program. fetchmailconf would create the initial output configuration file with insecure permissions and only after writing would it change permissions to be more restrictive. During that time, passwords and other data could be exposed to other users on the system unless the user used a more restrictive umask setting.

As well, the Mandriva Linux 2006 packages did not contain the patch that corrected the issues fixed in MDKSA-2005:126, namely a buffer overflow in fetchmail's POP3 client (CVE-2005-2355).

The updated packages have been patched to address this issue, and the Mandriva 2006 packages have also been patched to correct CVE-2005-2355.

The remote host is affected by the vulnerability described in GLSA-200511-06 (fetchmail: Password exposure in fetchmailconf)

    Thomas Wolff discovered that fetchmailconf opens the configuration     file with default permissions, writes the configuration to it, and only     then restricts read permissions to the owner.
  Impact :

    A local attacker could exploit the race condition to retrieve     sensitive information like IMAP/POP passwords.
  Workaround :

    Run 'umask 077' to temporarily strengthen default permissions,     then run 'fetchmailconf' from the same shell.

Updated fetchmail packages that fix insecure configuration file creation is now available.

This update has been rated as having low security impact by the Red Hat Security Response Team.

Fetchmail is a remote mail retrieval and forwarding utility.

A bug was found in the way the fetchmailconf utility program writes configuration files. The default behavior of fetchmailconf is to write a configuration file which may be world readable for a short period of time. This configuration file could provide passwords to a local malicious attacker within the short window before fetchmailconf sets secure permissions. The Common Vulnerabilities and Exposures project has assigned the name CVE-2005-3088 to this issue.

Users of fetchmail are advised to upgrade to these updated packages, which contain a backported patch which resolves this issue.

ID	Name	Product	Family	Severity
22766	Debian DSA-900-3 : fetchmail - programming error	Nessus	Debian Local Security Checks	low
22125	Mac OS X Multiple Vulnerabilities (Security Update 2006-004)	Nessus	MacOS X Local Security Checks	critical
21503	FreeBSD : fetchmail -- fetchmailconf local password exposure (baf74e0b-497a-11da-a4f4-0060084a00e5)	Nessus	FreeBSD Local Security Checks	low
20912	Slackware 10.0 / 10.1 / 10.2 / 8.1 / 9.0 / 9.1 / current : fetchmail (SSA:2006-045-01)	Nessus	Slackware Local Security Checks	high
20633	Ubuntu 4.10 / 5.04 / 5.10 : fetchmail vulnerability (USN-215-1)	Nessus	Ubuntu Local Security Checks	low
20442	Mandrake Linux Security Advisory : fetchmail (MDKSA-2005:209)	Nessus	Mandriva Local Security Checks	medium
20156	GLSA-200511-06 : fetchmail: Password exposure in fetchmailconf	Nessus	Gentoo Local Security Checks	low
20106	RHEL 2.1 : fetchmail (RHSA-2005:823)	Nessus	Red Hat Local Security Checks	low

Detections

Analytics

CVE-2005-3088

medium

Tenable Plugins

low

critical

low

high

low

medium

low

low