Due to restrictive dependency definition for fetchmail-ssl the updated fetchmailconf package couldn't be installed on the old stable distribution (woody) together with fetchmail-ssl.  Hence, this update loosens it, so that the update can be pulled in.  For completeness we're including the original advisory text :

  Thomas Wolff discovered that the fetchmailconf program which is   provided as part of fetchmail, an SSL enabled POP3, APOP, IMAP mail   gatherer/forwarder, creates the new configuration in an insecure   fashion that can lead to leaking passwords for mail accounts to   local users.

This update also fixes a regression in the package for stable caused by the last security update.

The fetchmail team reports :

The fetchmailconf program before and excluding version 1.49 opened the run control file, wrote the configuration to it, and only then changed the mode to 0600 (rw-------). Writing the file, which usually contains passwords, before making it unreadable to other users, can expose sensitive password information.

Updated fetchmail packages that fix insecure configuration file creation is now available.

This update has been rated as having low security impact by the Red Hat Security Response Team.

Fetchmail is a remote mail retrieval and forwarding utility.

A bug was found in the way the fetchmailconf utility program writes configuration files. The default behavior of fetchmailconf is to write a configuration file which may be world readable for a short period of time. This configuration file could provide passwords to a local malicious attacker within the short window before fetchmailconf sets secure permissions. The Common Vulnerabilities and Exposures project has assigned the name CVE-2005-3088 to this issue.

Users of fetchmail are advised to upgrade to these updated packages, which contain a backported patch which resolves this issue.

Thomas Wolff and Miloslav Trmac discovered a race condition in the fetchmailconf program. fetchmailconf would create the initial output configuration file with insecure permissions and only after writing would it change permissions to be more restrictive. During that time, passwords and other data could be exposed to other users on the system unless the user used a more restrictive umask setting.

As well, the Mandriva Linux 2006 packages did not contain the patch that corrected the issues fixed in MDKSA-2005:126, namely a buffer overflow in fetchmail's POP3 client (CVE-2005-2355).

The updated packages have been patched to address this issue, and the Mandriva 2006 packages have also been patched to correct CVE-2005-2355.

New fetchmail packages are available for Slackware 8.1, 9.0, 9.1, 10.0, 10.1, 10.2, and -current to fix security issues.

The remote host is affected by the vulnerability described in GLSA-200511-06 (fetchmail: Password exposure in fetchmailconf)

    Thomas Wolff discovered that fetchmailconf opens the configuration     file with default permissions, writes the configuration to it, and only     then restricts read permissions to the owner.
  Impact :

    A local attacker could exploit the race condition to retrieve     sensitive information like IMAP/POP passwords.
  Workaround :

    Run 'umask 077' to temporarily strengthen default permissions,     then run 'fetchmailconf' from the same shell.

The remote host is running Apple Mac OS X, but lacks Security Update 2006-004.

This security update contains fixes for the following applications :

AFP Server Bluetooth Bom DHCP dyld fetchmail gnuzip ImageIO LaunchServices OpenSSH telnet WebKit

Thomas Wolff and Miloslav Trmac discovered a race condition in the fetchmailconf program. The output configuration file was initially created with insecure permissions, and secure permissions were applied after writing the configuration into the file. During this time, the file was world readable on a standard system (unless the user manually tightened his umask setting), which could expose email passwords to local users.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Published	Updated	Severity
22766	Debian DSA-900-3 : fetchmail - programming error	Nessus	Debian Local Security Checks	10/14/2006	1/4/2021	low
21503	FreeBSD : fetchmail -- fetchmailconf local password exposure (baf74e0b-497a-11da-a4f4-0060084a00e5)	Nessus	FreeBSD Local Security Checks	5/13/2006	1/6/2021	low
20106	RHEL 2.1 : fetchmail (RHSA-2005:823)	Nessus	Red Hat Local Security Checks	10/28/2005	1/14/2021	low
20442	Mandrake Linux Security Advisory : fetchmail (MDKSA-2005:209)	Nessus	Mandriva Local Security Checks	1/15/2006	1/6/2021	medium
20912	Slackware 10.0 / 10.1 / 10.2 / 8.1 / 9.0 / 9.1 / current : fetchmail (SSA:2006-045-01)	Nessus	Slackware Local Security Checks	2/15/2006	1/14/2021	high
20156	GLSA-200511-06 : fetchmail: Password exposure in fetchmailconf	Nessus	Gentoo Local Security Checks	11/7/2005	1/6/2021	low
22125	Mac OS X Multiple Vulnerabilities (Security Update 2006-004)	Nessus	MacOS X Local Security Checks	8/1/2006	5/28/2024	critical
20633	Ubuntu 4.10 / 5.04 / 5.10 : fetchmail vulnerability (USN-215-1)	Nessus	Ubuntu Local Security Checks	1/15/2006	1/19/2021	low

Detections

Analytics

Plugins Search

low

low

low

medium

high

low

critical

low