Home    |    View Topics    |    Search    |    Contact Us    |   



Category:   Application (E-mail Server)  >   Fetchmail Vendors:
Fetchmail MDA Option Message Refusal Bugs Let Remote Users Deny Service
SecurityTracker Alert ID:  1017479
SecurityTracker URL:
CVE Reference:   CVE-2006-5974   (Links to External Site)
Date:  Jan 8 2007
Impact:   Denial of service via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 6.3.5, 6.3.6-rc1, 6.3.6-rc2
Description:   A vulnerability was reported in Fetchmail. A remote user can cause denial of service conditions.

A remote user can send a specially crafted message that, when delivered to a message delivery agent via the "mda" option, may cause the fetchmail process to crash when refusing the message.

SMTP and LMTP delivery modes are not affected.

Neil Hoggarth reported this vulnerability.

Impact:   A remote user can cause the target service to crash.
Solution:   The vendor has issued a fixed version (6.3.6).

The fetchmail advisory is available at:

Vendor URL: (Links to External Site)
Cause:   State error

Message History:   None.

 Source Message Contents

Subject:  fetchmail security announcement 2006-03 (CVE-2006-5974)

Hash: SHA1

fetchmail-SA-2006-03: crash when refusing message delivered through MDA

Topics:		fetchmail crashes when refusing a message bound for an MDA

Author:		Matthias Andree
Version:	1.0
Announced:	2007-01-04
Type:		denial of service
Impact:		fetchmail aborts prematurely
Danger:		low
Credits:	Neil Hoggarth (bug report and analysis)
CVE Name:	CVE-2006-5974
Project URL:

Affects:	fetchmail release = 6.3.5
		fetchmail release candidates 6.3.6-rc1, -rc2

Not affected:	fetchmail release 6.3.6

Corrected:	2006-11-14 fetchmail SVN

0. Release history

2006-11-19 -	internal review draft
2007-01-04 1.0	 ready for release

1. Background

fetchmail is a software package to retrieve mail from remote POP2, POP3,
IMAP, ETRN or ODMR servers and forward it to local SMTP, LMTP servers or
message delivery agents.

fetchmail ships with a graphical, Python/Tkinter based configuration
utility named "fetchmailconf" to help the user create configuration (run
control) files for fetchmail.

2. Problem description and Impact

Fetchmail 6.3.5 and early 6.3.6 release candidates, when delivering
messages to a message delivery agent by means of the "mda" option, can
crash (by passing a NULL pointer to ferror() and fflush()) when refusing
a message. SMTP and LMTP delivery modes aren't affected.

3. Workaround

Avoid the mda option and ship to a local SMTP or LMTP server instead.

4. Solution

Download and install fetchmail 6.3.6 or a newer stable release from
fetchmail's project site at

A. Copyright, License and Warranty

(C) Copyright 2007 by Matthias Andree, <>.
Some rights reserved.

This work is licensed under the Creative Commons
Attribution-NonCommercial-NoDerivs German License. To view a copy of
this license, visit
or send a letter to Creative Commons; 559 Nathan Abbott Way;
Stanford, California 94305; USA.

Use the information herein at your own risk.

END OF fetchmail-SA-2006-03.txt
Version: GnuPG v1.4.5 (GNU/Linux)



Go to the Top of This SecurityTracker Archive Page

Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2021, LLC