Fetchmail 5.0.8 through 6.3.21, when using NTLM authentication in debug mode, allows remote NTLM servers to (1) cause a denial of service (crash and delayed delivery of inbound mail) via a crafted NTLM response that triggers an out-of-bounds read in the base64 decoder, or (2) obtain sensitive information from memory via an NTLM Type 2 message with a crafted Target Name structure, which triggers an out-of-bounds read.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - fetchmail: DoS (crash) in the base64 decoder upon server NTLM protocol exchange abort right after the     initial request (CVE-2012-3482)

  - fetchmail 5.9.9 through 6.3.19 does not properly limit the wait time after issuing a (1) STARTTLS or (2)     STLS request, which allows remote servers to cause a denial of service (application hang) by acknowledging     the request but not sending additional packets. (CVE-2011-1947)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - fetchmail: DoS (crash) in the base64 decoder upon server NTLM protocol exchange abort right after the     initial request (CVE-2012-3482)

  - fetchmail 4.6.3 through 6.3.16, when debug mode is enabled, does not properly handle invalid characters in     a multi-character locale, which allows remote attackers to cause a denial of service (memory consumption     and application crash) via a crafted (1) message header or (2) POP3 UIDL list. (CVE-2010-1167)

  - fetchmail 5.9.9 through 6.3.19 does not properly limit the wait time after issuing a (1) STARTTLS or (2)     STLS request, which allows remote servers to cause a denial of service (application hang) by acknowledging     the request but not sending additional packets. (CVE-2011-1947)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

This update for fetchmail fixes the following issues :

  - CVE-2012-3482: A denial of service vulnerability in the     base64 decoder during processing server NTLM protocol     exchange was fixed (bsc#775988).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Solaris system is missing necessary patches to address security updates :

  - The SSL protocol, as used in certain configurations in     Microsoft Windows and Microsoft Internet Explorer,     Mozilla Firefox, Google Chrome, Opera, and other     products, encrypts data by using CBC mode with chained     initialization vectors, which allows man-in-the-middle     attackers to obtain plaintext HTTP headers via a     blockwise chosen-boundary attack (BCBA) on an HTTPS     session, in conjunction with JavaScript code that uses     (1) the HTML5 WebSocket API, (2) the Java URLConnection     API, or (3) the Silverlight WebClient API, aka a 'BEAST'     attack. (CVE-2011-3389)

  - Fetchmail 5.0.8 through 6.3.21, when using NTLM     authentication in debug mode, allows remote NTLM servers     to (1) cause a denial of service (crash and delayed     delivery of inbound mail) via a crafted NTLM response     that triggers an out-of-bounds read in the base64     decoder, or (2) obtain sensitive information from memory     via an NTLM Type 2 message with a crafted Target Name     structure, which triggers an out-of-bounds read.
    (CVE-2012-3482)

Multiple vulnerabilities has been found and corrected in fetchmail :

Fetchmail version 6.3.9 enabled all SSL workarounds (SSL_OP_ALL) which contains a switch to disable a countermeasure against certain attacks against block ciphers that permit guessing the initialization vectors, providing that an attacker can make the application (fetchmail) encrypt some data for him -- which is not easily the case (aka a BEAST attack) (CVE-2011-3389).

A denial of service flaw was found in the way Fetchmail, a remote mail retrieval and forwarding utility, performed base64 decoding of certain NTLM server responses. Upon sending the NTLM authentication request, Fetchmail did not check if the received response was actually part of NTLM protocol exchange, or server-side error message and session abort. A rogue NTML server could use this flaw to cause fetchmail executable crash (CVE-2012-3482).

This advisory provides the latest version of fetchmail (6.3.22) which is not vulnerable to these issues.

Package is updated to latest upstream version which fixes CVE-2012-3482.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Matthias Andree reports :

With NTLM support enabled, fetchmail might mistake a server-side error message during NTLM protocol exchange for protocol data, leading to a SIGSEGV.

Also, with a carefully crafted NTLM challenge, a malicious server might cause fetchmail to read from a bad memory location, betraying confidential data. It is deemed hard, although not impossible, to steal other accounts' data.

ID	Name	Product	Family	Severity
199115	RHEL 6 : fetchmail (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
199021	RHEL 5 : fetchmail (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
90185	SUSE SLED11 / SLES11 Security Update : fetchmail (SUSE-SU-2016:0872-1)	Nessus	SuSE Local Security Checks	medium
80605	Oracle Solaris Third-Party Patch Update : fetchmail (multiple_vulnerabilities_in_fetchmail) (BEAST)	Nessus	Solaris Local Security Checks	medium
69622	Amazon Linux AMI : fetchmail (ALAS-2012-132)	Nessus	Amazon Linux Local Security Checks	medium
66051	Mandriva Linux Security Advisory : fetchmail (MDVSA-2013:037)	Nessus	Mandriva Local Security Checks	medium
62399	Fedora 16 : fetchmail-6.3.22-1.fc16 (2012-14462)	Nessus	Fedora Local Security Checks	medium
62398	Fedora 17 : fetchmail-6.3.22-1.fc17 (2012-14451)	Nessus	Fedora Local Security Checks	medium
61992	Mandriva Linux Security Advisory : fetchmail (MDVSA-2012:149)	Nessus	Mandriva Local Security Checks	medium
61539	FreeBSD : fetchmail -- two vulnerabilities in NTLM authentication (83f9e943-e664-11e1-a66d-080027ef73ec)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2012-3482

critical

Tenable Plugins

critical

critical

medium

medium

medium

medium

medium

medium

medium

medium