Updated fetchmail packages that fix two security issues are now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

Fetchmail is a remote mail retrieval and forwarding utility.

A denial of service flaw was found when Fetchmail was run in multidrop mode. A malicious mail server could send a message without headers which would cause Fetchmail to crash (CVE-2005-4348). This issue did not affect the version of Fetchmail shipped with Red Hat Enterprise Linux 2.1 or 3.

A flaw was found in the way Fetchmail used TLS encryption to connect to remote hosts. Fetchmail provided no way to enforce the use of TLS encryption and would not authenticate POP3 protocol connections properly (CVE-2006-5867). This update corrects this issue by enforcing TLS encryption when the 'sslproto' configuration directive is set to 'tls1'.

Users of Fetchmail should update to these packages, which contain backported patches to correct these issues.

Note: This update may break configurations which assumed that Fetchmail would use plain-text authentication if TLS encryption is not supported by the POP3 server even if the 'sslproto' directive is set to 'tls1'. If you are using a custom configuration that depended on this behavior you will need to modify your configuration appropriately after installing this update.

Red Hat セキュリティアドバイザリ 2007:0018 から：

2 つのセキュリティの問題を修正する更新済みの fetchmail パッケージが、現在利用可能です。

Red Hat セキュリティレスポンスチームは、この更新は重要度中のセキュリティ影響があると評価しています。

Fetchmail は、メールの取得と転送をリモートで行うユーティリティです。

Fetchmail がマルチドロップモードで実行されたとき、サービス拒否の欠陥が見つかりました。悪意のあるメールサーバーが Fetchmail をクラッシュさせるようなヘッダーのないメッセージを送信する可能性があります（CVE-2005-4348）。この問題は、Red Hat Enterprise Linux 2.1 または 3 で出荷されたバージョンの Fetchmail には影響しません。

Fetchmail がリモートホストに接続するために TLS 暗号化を使用する方法に欠陥が見つかりました。Fetchmail は TLS 暗号化の使用を強制する方法は提供せず、POP3 プロトコル接続を適切に認証しません（CVE-2006-5867）。この更新は、「sslproto」構成ディレクティブが「tls1」に設定されているときに TLS 暗号化を強制することにより、この問題を修正します。

Fetchmail のユーザーは、バックポートされたパッチが含まれるこれらのパッケージへ更新し、これらの問題を修正する必要があります。

注：この更新は、「sslproto」ディレクティブが「tls1」に設定されても TLS 暗号が POP3 サーバーによりサポートされていない場合に Fetchmail が平文認証を使用することを前提としている構成を打ち砕く可能性があります。この挙動に依存するカスタム構成を使用している場合は、この更新のインストール後に構成を適切に修正する必要があります。

From Red Hat Security Advisory 2007:0018 :

Updated fetchmail packages that fix two security issues are now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

Fetchmail is a remote mail retrieval and forwarding utility.

A denial of service flaw was found when Fetchmail was run in multidrop mode. A malicious mail server could send a message without headers which would cause Fetchmail to crash (CVE-2005-4348). This issue did not affect the version of Fetchmail shipped with Red Hat Enterprise Linux 2.1 or 3.

A flaw was found in the way Fetchmail used TLS encryption to connect to remote hosts. Fetchmail provided no way to enforce the use of TLS encryption and would not authenticate POP3 protocol connections properly (CVE-2006-5867). This update corrects this issue by enforcing TLS encryption when the 'sslproto' configuration directive is set to 'tls1'.

Users of Fetchmail should update to these packages, which contain backported patches to correct these issues.

Note: This update may break configurations which assumed that Fetchmail would use plain-text authentication if TLS encryption is not supported by the POP3 server even if the 'sslproto' directive is set to 'tls1'. If you are using a custom configuration that depended on this behavior you will need to modify your configuration appropriately after installing this update.

The remote host is running Apple Mac OS X, but lacks Security Update 2006-004.

This security update contains fixes for the following applications :

AFP Server Bluetooth Bom DHCP dyld fetchmail gnuzip ImageIO LaunchServices OpenSSH telnet WebKit

Three security issues have been fixed in fetchmail :

CVE-2005-4348: fetchmail when configured for multidrop mode, allows remote attackers to cause a denial of service (application crash) by sending messages without headers from upstream mail servers.

CVE-2006-5867: fetchmail did not properly enforce TLS and may transmit cleartext passwords over unsecured links if certain circumstances occur, which allows remote attackers to obtain sensitive information via man-in-the-middle (MITM) attacks.

CVE-2006-5974: fetchmail when refusing a message delivered via the mda option, allowed remote attackers to cause a denial of service (crash) via unknown vectors that trigger a NULL pointer dereference when calling the ferror or fflush functions.

來自 Red Hat 安全性公告 2007:0018：

現已提供更新版 fetchmail 套件，可修正兩個安全性問題。

Red Hat 安全性回應團隊已將此更新評等為具有中等安全性影響。

Fetchmail 是一個遠端郵件擷取和轉寄公用程式。

當 Fetchmail 在多點模式下執行時，發現一個拒絕服務瑕疵。惡意郵件伺服器可傳送不含標頭的訊息，進而造成 Fetchmail 當機 (CVE-2005-4348)。此問題並未影響在 Red Hat Enterprise Linux 2.1 或 3 中隨附的 Fetchmail 版本。

在 Fetchmail 使用 TLS 加密連線至遠端主機的方式中發現一個瑕疵。Fetchmail 未提供任何方法來強制使用 TLS 加密，且不會正確驗證 POP3 通訊協定連線 (CVE-2006-5867)。此更新可在「sslproto」組態指示詞設定為「tls1」時，透過強制執行 TLS 加密來更正此問題。

Fetchmail 的使用者應更新至這些套件，其中包含可更正這些問題的反向移植修補程式。

注意：此更新可能會中斷如下組態：假定如果 POP3 伺服器不支援 TLS 加密，Fetchmail 會使用純文字驗證，即使「sslproto」指示詞設定為「tls1」也是如此。如果您使用取決於此行為的自訂組態，將需要在安裝此更新之後，適當地修改您的組態。

来自 Red Hat 安全公告 2007:0018：

更新后的 fetchmail 程序包修复了两个安全问题，现在可用。

Red Hat 安全响应团队将此更新评级为具有中等安全影响。

Fetchmail 是一个远程邮件检索和转发实用工具。

在多支路模式下运行 Fetchmail 时发现一个拒绝服务缺陷。恶意邮件服务器可发送无标头的消息，从而导致 Fetchmail 崩溃 (CVE-2005-4348)。此问题不会影响 Red Hat Enterprise Linux 2.1 或 3 随附的 Fetchmail 版本。

在 Fetchmail 使用 TLS 加密来连接到远程主机的方式中发现一个缺陷。Fetchmail 未提供强制使用 TLS 加密的方式，并且不会正确认证 POP3 协议连接 (CVE-2006-5867)。此更新通过在“sslproto”配置指令设置为“tls1”时强制 TLS 加密来修正此问题。

Fetchmail 用户应更新这些程序包，其中包含用于修正这些问题的向后移植的修补程序。

注意：如果 POP3 服务器不支持 TLS 加密，即使“sslproto”指令设置为“tls1”，此更新也可能破坏假设 Fetchmail 将使用明文认证的配置。如果正在使用依赖此行为的自定义配置，在安装此更新之后需要相应地修改配置。

Fetchmail before 6.3.1 and before 6.2.5.5, when configured for multidrop mode, allows remote attackers to cause a DoS (application crash) by sending messages without headers from upstream mail servers.

The updated packages have been patched to correct this problem.

Steve Fosdick discovered a remote Denial of Service vulnerability in fetchmail. When using fetchmail in 'multidrop' mode, a malicious email server could cause a crash by sending an email without any headers.
Since fetchmail is commonly called automatically (with cron, for example), this crash could go unnoticed.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

New fetchmail packages are available for Slackware 8.1, 9.0, 9.1, 10.0, 10.1, 10.2, and -current to fix security issues.

The fetchmail team reports :

Fetchmail contains a bug that causes an application crash when fetchmail is configured for multidrop mode and the upstream mail server sends a message without headers. As fetchmail does not record this message as 'previously fetched', it will crash with the same message if it is re-executed, so it cannot make progress. A malicious or broken-into upstream server could thus cause a denial of service in fetchmail clients.

Daniel Drake discovered a problem in fetchmail, an SSL enabled POP3, APOP, IMAP mail gatherer/forwarder, that can cause a crash when the program is running in multidrop mode and receives messages without headers.

The old stable distribution (woody) does not seem to be affected by this problem.

Three security issues have been fixed in fetchmail :

  - fetchmail when configured for multidrop mode, allows     remote attackers to cause a denial of service     (application crash) by sending messages without headers     from upstream mail servers. (CVE-2005-4348)

  - fetchmail did not properly enforce TLS and may transmit     cleartext passwords over unsecured links if certain     circumstances occur, which allows remote attackers to     obtain sensitive information via man-in-the-middle     (MITM) attacks. (CVE-2006-5867)

  - fetchmail when refusing a message delivered via the mda     option, allowed remote attackers to cause a denial of     service (crash) via unknown vectors that trigger a NULL     pointer dereference when calling the ferror or fflush     functions. (CVE-2006-5974)

ID	名稱	產品	系列	已發布	已更新	嚴重性
24316	RHEL 2.1 / 3 / 4 : fetchmail (RHSA-2007:0018)	Nessus	Red Hat Local Security Checks	2007/2/9	2021/1/14	high
67440	Oracle Linux 3/4：fetchmail（ELSA-2007-0018）	Nessus	Oracle Linux Local Security Checks	2013/7/12	2021/1/14	high
67440	Oracle Linux 3 / 4 : fetchmail (ELSA-2007-0018)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2021/1/14	high
24286	CentOS 3 / 4 : fetchmail (CESA-2007:0018)	Nessus	CentOS Local Security Checks	2007/2/9	2021/1/4	high
22125	Mac OS X Multiple Vulnerabilities (Security Update 2006-004)	Nessus	MacOS X Local Security Checks	2006/8/1	2024/5/28	critical
27213	openSUSE 10 Security Update : fetchmail (fetchmail-2602)	Nessus	SuSE Local Security Checks	2007/10/17	2021/1/14	high
67440	Oracle Linux 3 / 4：fetchmail (ELSA-2007-0018)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2021/1/14	high
67440	Oracle Linux 3 / 4：fetchmail (ELSA-2007-0018)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2021/1/14	high
20467	Mandrake Linux Security Advisory : fetchmail (MDKSA-2005:236)	Nessus	Mandriva Local Security Checks	2006/1/15	2021/1/6	high
20777	Ubuntu 4.10 / 5.04 / 5.10 : fetchmail vulnerability (USN-233-1)	Nessus	Ubuntu Local Security Checks	2006/1/21	2021/1/19	high
20912	Slackware 10.0 / 10.1 / 10.2 / 8.1 / 9.0 / 9.1 / current : fetchmail (SSA:2006-045-01)	Nessus	Slackware Local Security Checks	2006/2/15	2021/1/14	high
21541	FreeBSD : fetchmail -- NULL pointer dereference in multidrop mode with headerless email (f7eb0b23-7099-11da-a15c-0060084a00e5)	Nessus	FreeBSD Local Security Checks	2006/5/13	2021/1/6	high
22805	Debian DSA-939-1 : fetchmail - programming error	Nessus	Debian Local Security Checks	2006/10/14	2021/1/4	high
29425	SuSE 10 Security Update : fetchmail (ZYPP Patch Number 2608)	Nessus	SuSE Local Security Checks	2007/12/13	2021/1/14	high

偵測

搜尋 Plugin

high

high

high

high

critical

high

high

high

high

high

high

high

high

high