sink.c in fetchmail before 6.3.9 allows context-dependent attackers to cause a denial of service (NULL dereference and application crash) by refusing certain warning messages that are sent over SMTP.

The remote Oracle Linux 5 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2009-1427 advisory.

    [6.3.6-1.1.el5_3.1]
    - Fix fetchmail various flaws (CVE-2007-4565, CVE-2008-2711, CVE-2009-2666)       Resolves: #516269

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

CVE-2007-4565 Fetchmail NULL pointer dereference

CVE-2008-2711 fetchmail: Crash in large log messages in verbose mode

CVE-2009-2666 fetchmail: SSL null terminator bypass

It was discovered that fetchmail is affected by the previously published 'null prefix attack', caused by incorrect handling of NULL characters in X.509 certificates. If an attacker is able to get a carefully-crafted certificate signed by a trusted Certificate Authority, the attacker could use the certificate during a man-in-the-middle attack and potentially confuse fetchmail into accepting it by mistake. (CVE-2009-2666)

A flaw was found in the way fetchmail handles rejections from a remote SMTP server when sending warning mail to the postmaster. If fetchmail sent a warning mail to the postmaster of an SMTP server and that SMTP server rejected it, fetchmail could crash. (CVE-2007-4565)

A flaw was found in fetchmail. When fetchmail is run in double verbose mode ('-v -v'), it could crash upon receiving certain, malformed mail messages with long headers. A remote attacker could use this flaw to cause a denial of service if fetchmail was also running in daemon mode ('-d'). (CVE-2008-2711)

If fetchmail is running in daemon mode, it must be restarted for this update to take effect (use the 'fetchmail --quit' command to stop the fetchmail process).

This update fixes a remote denial-of-service attack. (CVE-2007-4565)

An updated fetchmail package that fixes multiple security issues is now available for Red Hat Enterprise Linux 3, 4, and 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

Fetchmail is a remote mail retrieval and forwarding utility intended for use over on-demand TCP/IP links, such as SLIP and PPP connections.

It was discovered that fetchmail is affected by the previously published 'null prefix attack', caused by incorrect handling of NULL characters in X.509 certificates. If an attacker is able to get a carefully-crafted certificate signed by a trusted Certificate Authority, the attacker could use the certificate during a man-in-the-middle attack and potentially confuse fetchmail into accepting it by mistake. (CVE-2009-2666)

A flaw was found in the way fetchmail handles rejections from a remote SMTP server when sending warning mail to the postmaster. If fetchmail sent a warning mail to the postmaster of an SMTP server and that SMTP server rejected it, fetchmail could crash. (CVE-2007-4565)

A flaw was found in fetchmail. When fetchmail is run in double verbose mode ('-v -v'), it could crash upon receiving certain, malformed mail messages with long headers. A remote attacker could use this flaw to cause a denial of service if fetchmail was also running in daemon mode ('-d'). (CVE-2008-2711)

Note: when using SSL-enabled services, it is recommended that the fetchmail '--sslcertck' option be used to enforce strict SSL certificate checking.

All fetchmail users should upgrade to this updated package, which contains backported patches to correct these issues. If fetchmail is running in daemon mode, it must be restarted for this update to take effect (use the 'fetchmail --quit' command to stop the fetchmail process).

The remote host is running a version of Mac OS X 10.5 or 10.4 that does not have Security Update 2009-001 applied.

This security update contains fixes for the following products :

  - AFP Server
  - Apple Pixlet Video
  - CarbonCore
  - CFNetwork
  - Certificate Assistant
  - ClamAV
  - CoreText
  - CUPS
  - DS Tools
  - fetchmail
  - Folder Manager
  - FSEvents
  - Network Time
  - perl
  - Printing
  - python
  - Remote Apple Events
  - Safari RSS
  - servermgrd
  - SMB
  - SquirrelMail
  - X11
  - XTerm

Gaetan Leurent discovered a vulnerability in the APOP protocol based on MD5 collisions. As fetchmail supports the APOP protocol, this vulnerability can be used by attackers to discover a portion of the APOP user's authentication credentials. (CVE-2007-1558)

Earl Chew discovered that fetchmail can be made to de-reference a NULL pointer when contacting SMTP servers. This vulnerability can be used by attackers who control the SMTP server to crash fetchmail and cause a denial of service. (CVE-2007-4565).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Mon Sep 3 2007 Vitezslav Crhonek <vcrhonek at     redhat.com> - 6.3.7-2

    - Fix license

    - Fix fetchmail NULL pointer dereference (CVE-2007-4565)       Resolves: #260861

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Matthias Andree discovered that fetchmail, an SSL enabled POP3, APOP and IMAP mail gatherer/forwarder, can under certain circumstances attempt to dereference a NULL pointer and crash.

A vulnerability in fetchmail was found where it could crash when attempting to deliver an internal warning or error message through an untrusted or compromised SMTP server, leading to a denial of service.

Updated packages have been patched to prevent these issues.

Matthias Andree reports :

fetchmail will generate warning messages in certain circumstances (for instance, when leaving oversized messages on the server or login to the upstream fails) and send them to the local postmaster or the user running it.

If this warning message is then refused by the SMTP listener that fetchmail is forwarding the message to, fetchmail crashes and does not collect further messages until it is restarted.

ID	Name	Product	Family	Severity
67920	Oracle Linux 5 : fetchmail (ELSA-2009-1427)	Nessus	Oracle Linux Local Security Checks	high
60662	Scientific Linux Security Update : fetchmail on SL3.x, SL4.x, SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
41154	SuSE9 Security Update : fetchmail (YOU Patch Number 11814)	Nessus	SuSE Local Security Checks	medium
40901	RHEL 3 / 4 / 5 : fetchmail (RHSA-2009:1427)	Nessus	Red Hat Local Security Checks	medium
40893	CentOS 3 / 4 / 5 : fetchmail (CESA-2009:1427)	Nessus	CentOS Local Security Checks	medium
35684	Mac OS X Multiple Vulnerabilities (Security Update 2009-001)	Nessus	MacOS X Local Security Checks	critical
29426	SuSE 10 Security Update : fetchmail (ZYPP Patch Number 4462)	Nessus	SuSE Local Security Checks	medium
28125	Ubuntu 6.06 LTS / 6.10 / 7.04 : fetchmail vulnerabilities (USN-520-1)	Nessus	Ubuntu Local Security Checks	medium
27742	Fedora 7 : fetchmail-6.3.7-2.fc7 (2007-1983)	Nessus	Fedora Local Security Checks	medium
27572	openSUSE 10 Security Update : fetchmail (fetchmail-4490)	Nessus	SuSE Local Security Checks	medium
26080	Debian DSA-1377-2 : fetchmail - NULL pointer dereference	Nessus	Debian Local Security Checks	medium
26046	Mandrake Linux Security Advisory : fetchmail (MDKSA-2007:179)	Nessus	Mandriva Local Security Checks	medium
25981	FreeBSD : fetchmail -- denial of service on reject of local warning message (45500f74-5947-11dc-87c1-000e2e5785ad)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2007-4565

high

Tenable Plugins

high

medium

medium

medium

medium

critical

medium

medium

medium

medium

medium

medium

medium