fetchmail 6.3.0 and other versions before 6.3.2 allows remote attackers to cause a denial of service (crash) via crafted e-mail messages that cause a free of an invalid pointer when fetchmail bounces the message to the originator or local postmaster.

The remote host is running Apple Mac OS X, but lacks Security Update 2006-004.

This security update contains fixes for the following applications :

AFP Server Bluetooth Bom DHCP dyld fetchmail gnuzip ImageIO LaunchServices OpenSSH telnet WebKit

Matthias Andree reports :

Fetchmail contains a bug that causes itself to crash when bouncing a message to the originator or to the local postmaster. The crash happens after the bounce message has been sent, when fetchmail tries to free the dynamic array of failed addresses, and calls the free() function with an invalid pointer.

New fetchmail packages are available for Slackware 8.1, 9.0, 9.1, 10.0, 10.1, 10.2, and -current to fix security issues.

ID	Name	Product	Family	Severity
22125	Mac OS X Multiple Vulnerabilities (Security Update 2006-004)	Nessus	MacOS X Local Security Checks	critical
21533	FreeBSD : fetchmail -- crash when bouncing a message (f11d3b22-88c6-11da-a7b2-0060084a00e5)	Nessus	FreeBSD Local Security Checks	medium
20912	Slackware 10.0 / 10.1 / 10.2 / 8.1 / 9.0 / 9.1 / current : fetchmail (SSA:2006-045-01)	Nessus	Slackware Local Security Checks	high

Detections

Analytics

CVE-2006-0321

medium

Tenable Plugins

critical

medium

high