Fetchmail Can Be Crashed By Remote Users By Sending a Headerless Message
|
|
SecurityTracker Alert ID: 1015383
|
|
SecurityTracker URL: http://securitytracker.com/id?1015383
|
|
CVE Reference: CVE-2005-4348
(Links to External Site)
|
Date: Dec 20 2005
|
Impact: Denial of service via network
|
Fix Available: Yes
Exploit Included: Yes
Vendor Confirmed: Yes
|
Version(s): 6.2.5.4, 6.3.0
|
Description: A vulnerability was reported in Fetchmail. A remote server can cause Fetchmail to crash.
When Fetchmail is configured for multidrop mode, a remote server can send an e-mail message without headers to cause Fetchmail to crash.
The vendor credits Daniel Drake of Gentoo with reporting this vulnerability.
|
Impact: A remote server can cause fetchmail to crash when downloading a message.
|
Solution: The vendor has released fixed versions (6.2.5.5, 6.3.1), available at:
http://developer.berlios.de/project/showfiles.php?group_id=1824
|
Vendor URL: fetchmail.berlios.de/fetchmail-SA-2005-03.txt (Links to External Site)
|
Cause: Exception handling error
|
Underlying OS: Linux (Any), UNIX (Any)
|
|
Message History:
This archive entry has one or more follow-up message(s) listed below.
|
Source Message Contents
|
Date: Tue, 20 Dec 2005 11:54:05 -0500
Subject: Fetchmail vulnerability
|
http://fetchmail.berlios.de/fetchmail-SA-2005-03.txt
CVE-2005-4348
|
|
