fetchmail 6.3.5 and 6.3.6 before 6.3.6-rc4, when refusing a message delivered via the mda option, allows remote attackers to cause a denial of service (crash) via unknown vectors that trigger a NULL pointer dereference when calling the (1) ferror or (2) fflush functions.

Three security issues have been fixed in fetchmail :

  - fetchmail when configured for multidrop mode, allows     remote attackers to cause a denial of service     (application crash) by sending messages without headers     from upstream mail servers. (CVE-2005-4348)

  - fetchmail did not properly enforce TLS and may transmit     cleartext passwords over unsecured links if certain     circumstances occur, which allows remote attackers to     obtain sensitive information via man-in-the-middle     (MITM) attacks. (CVE-2006-5867)

  - fetchmail when refusing a message delivered via the mda     option, allowed remote attackers to cause a denial of     service (crash) via unknown vectors that trigger a NULL     pointer dereference when calling the ferror or fflush     functions. (CVE-2006-5974)

Three security issues have been fixed in fetchmail :

CVE-2005-4348: fetchmail when configured for multidrop mode, allows remote attackers to cause a denial of service (application crash) by sending messages without headers from upstream mail servers.

CVE-2006-5867: fetchmail did not properly enforce TLS and may transmit cleartext passwords over unsecured links if certain circumstances occur, which allows remote attackers to obtain sensitive information via man-in-the-middle (MITM) attacks.

CVE-2006-5974: fetchmail when refusing a message delivered via the mda option, allowed remote attackers to cause a denial of service (crash) via unknown vectors that trigger a NULL pointer dereference when calling the ferror or fflush functions.

New fetchmail packages are available for Slackware 8.1, 9.0, 9.1, 10.0, 10.1, 10.2, and 11.0 to fix a security issue.

The remote host is affected by the vulnerability described in GLSA-200701-13 (Fetchmail: Denial of Service and password disclosure)

    Neil Hoggarth has discovered that when delivering messages to a message     delivery agent by means of the 'mda' option, Fetchmail passes a NULL     pointer to the ferror() and fflush() functions when refusing a message.
    Isaac Wilcox has discovered numerous means of plain-text password     disclosure due to errors in secure connection establishment.
  Impact :

    An attacker could deliver a message via Fetchmail to a message delivery     agent configured to refuse the message, and crash the Fetchmail     process. SMTP and LMTP delivery modes are not affected by this     vulnerability. An attacker could also perform a Man-in-the-Middle     attack, and obtain plain-text authentication credentials of users     connecting to a Fetchmail process.
  Workaround :

    There is no known workaround at this time.

- Sat Jan 6 2007 Miloslav Trmac <mitr at redhat.com> -     6.3.6-1

    - Update to fetchmail-6.3.6 (CVE-2006-5867,       CVE-2006-5974)

    - Wed Nov 1 2006 Miloslav Trmac <mitr at redhat.com> -       6.3.5-1

    - Update to fetchmail-6.3.5

    - Fix some rpmlint warnings

    - Sun Sep 24 2006 Miloslav Trmac <mitr at redhat.com> -       6.3.4-2

    - Don't increase the certificate search path on each       poll (#206346)

    - Wed Jul 12 2006 Jesse Keating <jkeating at redhat.com>
      - 6.3.4-1.1

    - rebuild

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Matthias Andree reports :

When delivering messages to a message delivery agent by means of the 'mda' option, fetchmail can crash (by passing a NULL pointer to ferror() and fflush()) when refusing a message. SMTP and LMTP delivery modes aren't affected.

ID	Name	Product	Family	Severity
29425	SuSE 10 Security Update : fetchmail (ZYPP Patch Number 2608)	Nessus	SuSE Local Security Checks	high
27213	openSUSE 10 Security Update : fetchmail (fetchmail-2602)	Nessus	SuSE Local Security Checks	high
24666	Slackware 10.0 / 10.1 / 10.2 / 11.0 / 8.1 / 9.0 / 9.1 : fetchmail (SSA:2007-024-01)	Nessus	Slackware Local Security Checks	high
24249	GLSA-200701-13 : Fetchmail: Denial of Service and password disclosure	Nessus	Gentoo Local Security Checks	high
24194	Fedora Core 5 : fetchmail-6.3.6-1.fc5 (2007-041)	Nessus	Fedora Local Security Checks	high
23985	FreeBSD : fetchmail -- crashes when refusing a message bound for an MDA (37e30313-9d8c-11db-858b-0060084a00e5)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2006-5974

high

Tenable Plugins

high

high

high

high

high

high