Home    |    View Topics    |    Search    |    Contact Us    |   



Category:   Application (E-mail Server)  >   Fetchmail Vendors:
Fetchmail TLS Security Bugs May Let Eavesdroppers Obtain Passwords
SecurityTracker Alert ID:  1017478
SecurityTracker URL:
CVE Reference:   CVE-2006-5867   (Links to External Site)
Date:  Jan 8 2007
Impact:   Disclosure of authentication information
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 6.3.6-rc3 and prior versions
Description:   A vulnerability was reported in Fetchmail. A remote user with access to the intermediate network may be able to obtain passwords.

In several configuration options, fetchmail may fail to detect man-in-the-middle attacks or may incorrectly use a non-secure option when connecting to a mail server. This may allow a remote user that is monitoring the network to obtain passwords as they are transmitted as clear text.

Isaac Wilcox reported this vulnerability.

Impact:   A remote user monitoring the intermediate network may be able to obtain passwords.
Solution:   The vendor has issued a fixed version (6.3.6-rc4).

The fetchmail advisory is available at:

Vendor URL: (Links to External Site)
Cause:   Access control error, State error
Underlying OS:  Linux (Any), UNIX (Any)

Message History:   This archive entry has one or more follow-up message(s) listed below.
Jan 31 2007 (Red Hat Issues Fix) Fetchmail TLS Security Bugs May Let Eavesdroppers Obtain Passwords
Red Hat has released a fix for Red Hat Enterprise Linux 2.1, 3, and 4.

 Source Message Contents

Subject:  fetchmail security announcement 2006-02 (CVE-2006-5867)

Hash: SHA1

fetchmail-SA-2006-02: TLS enforcement problem/MITM attack/password exposure

Topics:		fetchmail cannot enforce TLS

Author:		Matthias Andree
Version:	1.0
Announced:	2007-01-04
Type:		secret information disclosure
Impact:		fetchmail can expose cleartext password over unsecure link
		fetchmail may not detect man in the middle attacks
Danger:		medium
Credits:	Isaac Wilcox (bug report, testing, collaboration on fix)
CVE Name:	CVE-2006-5867
Project URL:

Affects:	fetchmail releases <= 6.3.5
		fetchmail release candidates 6.3.6-rc1, -rc2, -rc3

Not affected:	fetchmail release candidates 6.3.6-rc4, -rc5
		fetchmail release 6.3.6

Corrected:	2006-11-26 fetchmail 6.3.6-rc4

0. Release history

2006-11-16	v0.01 internal review draft
2006-11-26	v0.02 revise failure cases, workaround, add acknowledgments
2006-11-27	v0.03 add more vulnerabilities
2006-01-04	v1.0  ready for release

1. Background

fetchmail is a software package to retrieve mail from remote POP2, POP3,
IMAP, ETRN or ODMR servers and forward it to local SMTP, LMTP servers or
message delivery agents.

fetchmail ships with a graphical, Python/Tkinter based configuration
utility named "fetchmailconf" to help the user create configuration (run
control) files for fetchmail.

2. Problem description and Impact

Fetchmail has had several nasty password disclosure vulnerabilities for
a long time. It was only recently that these have been found.

V1. sslcertck/sslfingerprint options should have implied "sslproto tls1"
    in order to enforce TLS negotiation, but did not.

V2. Even with "sslproto tls1" in the config, fetches would go ahead
    in plain text if STLS/STARTTLS wasn't available (not advertised,
    or advertised but rejected).

V3. POP3 fetches could completely ignore all TLS options whether
    available or not because it didn't reliably issue CAPA before
    checking for STLS support - but CAPA is a requisite for STLS.
    Whether or not CAPAbilities were probed, depended on the "auth"
    option. (Fetchmail only tried CAPA if the auth option was not set at
    all, was set to gssapi, kerberos, kerberos_v4, otp, or cram-md5.)

V4. POP3 could fall back to using plain text passwords, even if strong
    authentication had been configured.

V5. POP2 would not complain if strong authentication or TLS had been

This can cause eavesdroppers to obtain the password, depending on the
authentication scheme that is configured or auto-selected, and
subsequently impersonate somebody else when logging into the upstream

3. Workaround

If your upstream offers SSLv3-wrapped service on a dedicated port,
use   fetchmail --ssl --sslcertck --sslproto ssl3   on the command line,
or equivalent in the run control file.  This encrypts the whole session.

4. Solution

Download and install fetchmail 6.3.6 or a newer stable release from
fetchmail's project site at

5. Acknowledgments

Isaac Wilcox has been a great help with testing the fixes and getting
them right.

A. Copyright, License and Warranty

(C) Copyright 2007 by Matthias Andree, <>.
Some rights reserved.

This work is licensed under the Creative Commons
Attribution-NonCommercial-NoDerivs German License. To view a copy of
this license, visit
or send a letter to Creative Commons; 559 Nathan Abbott Way;
Stanford, California 94305; USA.

Use the information herein at your own risk.

END OF fetchmail-SA-2006-02.txt
Version: GnuPG v1.4.5 (GNU/Linux)



Go to the Top of This SecurityTracker Archive Page

Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2021, LLC