SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (E-mail Client)  >   Fetchmail Vendors:   Raymond, Eric S.
(Gentoo Issues Fix) Fetchmail Can Be Crashed By Remote Users Sending E-mail With Long Lines
SecurityTracker Alert ID:  1009626
SecurityTracker URL:  http://securitytracker.com/id/1009626
CVE Reference:   CVE-2003-0792   (Links to External Site)
Date:  Apr 1 2004
Impact:   Denial of service via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 6.2.4
Description:   A denial of service vulnerability was reported in fetchmail in the processing of long lines. A remote user can cause fetchmail to crash.

It is reported that a remote user can create a specially crafted email message to cause fetchmail to crash. Reports indicate that fetchmail does not properly allocate memory when processing long lines.

No further details were provided.

Impact:   A remote user can cause fetchmail to crash.
Solution:   Gentoo has released a fix and indicates that Fetchmail users should upgrade to version 6.2.5 or later:

# emerge sync
# emerge -pv ">=net-mail/fetchmail-6.2.5"
# emerge ">=net-mail/fetchmail-6.2.5"

Vendor URL:  catb.org/~esr/fetchmail/ (Links to External Site)
Cause:   Exception handling error
Underlying OS:  Linux (Gentoo)

Message History:   This archive entry is a follow-up to the message listed below.
Oct 17 2003 Fetchmail Can Be Crashed By Remote Users Sending E-mail With Long Lines



 Source Message Contents

Subject:  [gentoo-announce] [ GLSA 200403-10 ] Fetchmail 6.2.5 fixes a remote DoS



--EFrEOWQ9ye2lTNjK
Content-Type: text/plain; charset=iso-8859-1
Content-Disposition: inline

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory                           GLSA 200403-10
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                                             http://security.gentoo.org
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

  Severity: Normal
     Title: Fetchmail 6.2.5 fixes a remote DoS
      Date: March 30, 2004
      Bugs: #37717
        ID: 200403-10

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
========

Fetchmail versions 6.2.4 and earlier can be crashed by sending a
specially-crafted email to a fetchmail user.

Background
==========

Fetchmail is a utility that retrieves and forwards mail from remote
systems using IMAP, POP, and other protocols.

Affected packages
=================

    -------------------------------------------------------------------
     Package             /   Vulnerable   /                 Unaffected
    -------------------------------------------------------------------
     net-mail/fetchmail       <= 6.2.4                        >= 6.2.5

Description
===========

Fetchmail versions 6.2.4 and earlier can be crashed by sending a
specially-crafted email to a fetchmail user. This problem occurs
because Fetchmail does not properly allocate memory for long lines in
an incoming email.

Impact
======

Fetchmail users who receive a malicious email may have their fetchmail
program crash.

Workaround
==========

While a workaround is not currently known for this issue, all users are
advised to upgrade to the latest version of the affected package.

Resolution
==========

Fetchmail users should upgrade to version 6.2.5 or later:

    # emerge sync
    # emerge -pv ">=net-mail/fetchmail-6.2.5"
    # emerge ">=net-mail/fetchmail-6.2.5"

References
==========

  [ 1 ] http://xforce.iss.net/xforce/xfdb/13450
  [ 2 ] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0792

Concerns?
=========

Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
http://bugs.gentoo.org.

--EFrEOWQ9ye2lTNjK
Content-Type: application/pgp-signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.3 (GNU/Linux)

iD8DBQFAanfvJPpRNiftIEYRAscGAJ9SSuMM6K/NpReNuHwrYY7syX3erwCfRKSm
TNRLyeiEQcT7bUg56G0EEDQ=
=5Ypa
-----END PGP SIGNATURE-----

--EFrEOWQ9ye2lTNjK--

 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2021, SecurityGlobal.net LLC