Fetchmail Can Be Crashed By Remote Users By Sending a Headerless Message
|
|
SecurityTracker Alert ID: 1015383 |
|
SecurityTracker URL: http://securitytracker.com/id/1015383
|
|
CVE Reference:
CVE-2005-4348
(Links to External Site)
|
Date: Dec 20 2005
|
Impact:
Denial of service via network
|
Fix Available: Yes Vendor Confirmed: Yes Exploit Included: Yes
|
Version(s): 6.2.5.4, 6.3.0
|
Description:
A vulnerability was reported in Fetchmail. A remote server can cause Fetchmail to crash.
When Fetchmail is configured for multidrop mode, a remote server can send an e-mail message without headers to cause Fetchmail to crash.
The vendor credits Daniel Drake of Gentoo with reporting this vulnerability.
|
Impact:
A remote server can cause fetchmail to crash when downloading a message.
|
Solution:
The vendor has released fixed versions (6.2.5.5, 6.3.1), available at:
http://developer.berlios.de/project/showfiles.php?group_id=1824
|
Vendor URL: fetchmail.berlios.de/fetchmail-SA-2005-03.txt (Links to External Site)
|
Cause:
Exception handling error
|
Underlying OS:
Linux (Any), UNIX (Any)
|
|
Message History:
This archive entry has one or more follow-up message(s) listed below.
|
Source Message Contents
|
Date: Tue, 20 Dec 2005 11:54:05 -0500
Subject: Fetchmail vulnerability
|
http://fetchmail.berlios.de/fetchmail-SA-2005-03.txt
CVE-2005-4348
|
|
