Vulnerabilities > CVE-2005-4348 - Resource Management Errors vulnerability in Fetchmail
Attack vector
NETWORK Attack complexity
LOW Privileges required
NONE Confidentiality impact
NONE Integrity impact
NONE Availability impact
COMPLETE Summary
fetchmail before 6.3.1 and before 6.2.5.5, when configured for multidrop mode, allows remote attackers to cause a denial of service (application crash) by sending messages without headers from upstream mail servers.
Vulnerable Configurations
Part | Description | Count |
---|---|---|
Application | 10 |
Common Weakness Enumeration (CWE)
Nessus
NASL family FreeBSD Local Security Checks NASL id FREEBSD_PKG_F7EB0B23709911DAA15C0060084A00E5.NASL description The fetchmail team reports : Fetchmail contains a bug that causes an application crash when fetchmail is configured for multidrop mode and the upstream mail server sends a message without headers. As fetchmail does not record this message as last seen 2020-06-01 modified 2020-06-02 plugin id 21541 published 2006-05-13 reporter This script is Copyright (C) 2006-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/21541 title FreeBSD : fetchmail -- NULL pointer dereference in multidrop mode with headerless email (f7eb0b23-7099-11da-a15c-0060084a00e5) NASL family Debian Local Security Checks NASL id DEBIAN_DSA-939.NASL description Daniel Drake discovered a problem in fetchmail, an SSL enabled POP3, APOP, IMAP mail gatherer/forwarder, that can cause a crash when the program is running in multidrop mode and receives messages without headers. The old stable distribution (woody) does not seem to be affected by this problem. last seen 2020-06-01 modified 2020-06-02 plugin id 22805 published 2006-10-14 reporter This script is Copyright (C) 2006-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/22805 title Debian DSA-939-1 : fetchmail - programming error NASL family Oracle Linux Local Security Checks NASL id ORACLELINUX_ELSA-2007-0018.NASL description From Red Hat Security Advisory 2007:0018 : Updated fetchmail packages that fix two security issues are now available. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Fetchmail is a remote mail retrieval and forwarding utility. A denial of service flaw was found when Fetchmail was run in multidrop mode. A malicious mail server could send a message without headers which would cause Fetchmail to crash (CVE-2005-4348). This issue did not affect the version of Fetchmail shipped with Red Hat Enterprise Linux 2.1 or 3. A flaw was found in the way Fetchmail used TLS encryption to connect to remote hosts. Fetchmail provided no way to enforce the use of TLS encryption and would not authenticate POP3 protocol connections properly (CVE-2006-5867). This update corrects this issue by enforcing TLS encryption when the last seen 2020-06-01 modified 2020-06-02 plugin id 67440 published 2013-07-12 reporter This script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/67440 title Oracle Linux 3 / 4 : fetchmail (ELSA-2007-0018) NASL family MacOS X Local Security Checks NASL id MACOSX_SECUPD2006-004.NASL description The remote host is running Apple Mac OS X, but lacks Security Update 2006-004. This security update contains fixes for the following applications : AFP Server Bluetooth Bom DHCP dyld fetchmail gnuzip ImageIO LaunchServices OpenSSH telnet WebKit last seen 2020-06-01 modified 2020-06-02 plugin id 22125 published 2006-08-01 reporter This script is Copyright (C) 2006-2018 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/22125 title Mac OS X Multiple Vulnerabilities (Security Update 2006-004) NASL family Slackware Local Security Checks NASL id SLACKWARE_SSA_2006-045-01.NASL description New fetchmail packages are available for Slackware 8.1, 9.0, 9.1, 10.0, 10.1, 10.2, and -current to fix security issues. last seen 2020-06-01 modified 2020-06-02 plugin id 20912 published 2006-02-15 reporter This script is Copyright (C) 2006-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/20912 title Slackware 10.0 / 10.1 / 10.2 / 8.1 / 9.0 / 9.1 / current : fetchmail (SSA:2006-045-01) NASL family Mandriva Local Security Checks NASL id MANDRAKE_MDKSA-2005-236.NASL description Fetchmail before 6.3.1 and before 6.2.5.5, when configured for multidrop mode, allows remote attackers to cause a DoS (application crash) by sending messages without headers from upstream mail servers. The updated packages have been patched to correct this problem. last seen 2020-06-01 modified 2020-06-02 plugin id 20467 published 2006-01-15 reporter This script is Copyright (C) 2006-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/20467 title Mandrake Linux Security Advisory : fetchmail (MDKSA-2005:236) NASL family Ubuntu Local Security Checks NASL id UBUNTU_USN-233-1.NASL description Steve Fosdick discovered a remote Denial of Service vulnerability in fetchmail. When using fetchmail in last seen 2020-06-01 modified 2020-06-02 plugin id 20777 published 2006-01-21 reporter Ubuntu Security Notice (C) 2006-2019 Canonical, Inc. / NASL script (C) 2006-2016 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/20777 title Ubuntu 4.10 / 5.04 / 5.10 : fetchmail vulnerability (USN-233-1) NASL family Red Hat Local Security Checks NASL id REDHAT-RHSA-2007-0018.NASL description Updated fetchmail packages that fix two security issues are now available. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Fetchmail is a remote mail retrieval and forwarding utility. A denial of service flaw was found when Fetchmail was run in multidrop mode. A malicious mail server could send a message without headers which would cause Fetchmail to crash (CVE-2005-4348). This issue did not affect the version of Fetchmail shipped with Red Hat Enterprise Linux 2.1 or 3. A flaw was found in the way Fetchmail used TLS encryption to connect to remote hosts. Fetchmail provided no way to enforce the use of TLS encryption and would not authenticate POP3 protocol connections properly (CVE-2006-5867). This update corrects this issue by enforcing TLS encryption when the last seen 2020-06-01 modified 2020-06-02 plugin id 24316 published 2007-02-09 reporter This script is Copyright (C) 2007-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/24316 title RHEL 2.1 / 3 / 4 : fetchmail (RHSA-2007:0018) NASL family SuSE Local Security Checks NASL id SUSE_FETCHMAIL-2602.NASL description Three security issues have been fixed in fetchmail : CVE-2005-4348: fetchmail when configured for multidrop mode, allows remote attackers to cause a denial of service (application crash) by sending messages without headers from upstream mail servers. CVE-2006-5867: fetchmail did not properly enforce TLS and may transmit cleartext passwords over unsecured links if certain circumstances occur, which allows remote attackers to obtain sensitive information via man-in-the-middle (MITM) attacks. CVE-2006-5974: fetchmail when refusing a message delivered via the mda option, allowed remote attackers to cause a denial of service (crash) via unknown vectors that trigger a NULL pointer dereference when calling the ferror or fflush functions. last seen 2020-06-01 modified 2020-06-02 plugin id 27213 published 2007-10-17 reporter This script is Copyright (C) 2007-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/27213 title openSUSE 10 Security Update : fetchmail (fetchmail-2602) NASL family SuSE Local Security Checks NASL id SUSE_FETCHMAIL-2608.NASL description Three security issues have been fixed in fetchmail : - fetchmail when configured for multidrop mode, allows remote attackers to cause a denial of service (application crash) by sending messages without headers from upstream mail servers. (CVE-2005-4348) - fetchmail did not properly enforce TLS and may transmit cleartext passwords over unsecured links if certain circumstances occur, which allows remote attackers to obtain sensitive information via man-in-the-middle (MITM) attacks. (CVE-2006-5867) - fetchmail when refusing a message delivered via the mda option, allowed remote attackers to cause a denial of service (crash) via unknown vectors that trigger a NULL pointer dereference when calling the ferror or fflush functions. (CVE-2006-5974) last seen 2020-06-01 modified 2020-06-02 plugin id 29425 published 2007-12-13 reporter This script is Copyright (C) 2007-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/29425 title SuSE 10 Security Update : fetchmail (ZYPP Patch Number 2608) NASL family CentOS Local Security Checks NASL id CENTOS_RHSA-2007-0018.NASL description Updated fetchmail packages that fix two security issues are now available. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Fetchmail is a remote mail retrieval and forwarding utility. A denial of service flaw was found when Fetchmail was run in multidrop mode. A malicious mail server could send a message without headers which would cause Fetchmail to crash (CVE-2005-4348). This issue did not affect the version of Fetchmail shipped with Red Hat Enterprise Linux 2.1 or 3. A flaw was found in the way Fetchmail used TLS encryption to connect to remote hosts. Fetchmail provided no way to enforce the use of TLS encryption and would not authenticate POP3 protocol connections properly (CVE-2006-5867). This update corrects this issue by enforcing TLS encryption when the last seen 2020-06-01 modified 2020-06-02 plugin id 24286 published 2007-02-09 reporter This script is Copyright (C) 2007-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/24286 title CentOS 3 / 4 : fetchmail (CESA-2007:0018)
Oval
accepted | 2013-04-29T04:21:07.736-04:00 | ||||||||||||||||||||
class | vulnerability | ||||||||||||||||||||
contributors |
| ||||||||||||||||||||
definition_extensions |
| ||||||||||||||||||||
description | fetchmail before 6.3.1 and before 6.2.5.5, when configured for multidrop mode, allows remote attackers to cause a denial of service (application crash) by sending messages without headers from upstream mail servers. | ||||||||||||||||||||
family | unix | ||||||||||||||||||||
id | oval:org.mitre.oval:def:9659 | ||||||||||||||||||||
status | accepted | ||||||||||||||||||||
submitted | 2010-07-09T03:56:16-04:00 | ||||||||||||||||||||
title | fetchmail before 6.3.1 and before 6.2.5.5, when configured for multidrop mode, allows remote attackers to cause a denial of service (application crash) by sending messages without headers from upstream mail servers. | ||||||||||||||||||||
version | 26 |
Redhat
advisories |
| ||||
rpms |
|
Statements
contributor | Mark J Cox |
lastmodified | 2007-01-31 |
organization | Red Hat |
statement | The Red Hat Security Response Team has rated this issue as having low security impact. An update is available for Red Hat Enterprise Linux 4 to correct this issue: http://rhn.redhat.com/errata/RHSA-2007-0018.html This issue did not affect Red Hat Enterprise Linux 2.1 and 3. |
References
- ftp://patches.sgi.com/support/free/security/advisories/20070201-01-P.asc
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=343836
- http://fetchmail.berlios.de/fetchmail-SA-2005-03.txt
- http://secunia.com/advisories/17891
- http://secunia.com/advisories/18172
- http://secunia.com/advisories/18231
- http://secunia.com/advisories/18266
- http://secunia.com/advisories/18433
- http://secunia.com/advisories/18463
- http://secunia.com/advisories/18895
- http://secunia.com/advisories/21253
- http://secunia.com/advisories/24007
- http://secunia.com/advisories/24284
- http://securitytracker.com/id?1015383
- http://slackware.com/security/viewer.php?l=slackware-security&y=2006&m=slackware-security.443499
- http://www.debian.org/security/2005/dsa-939
- http://www.novell.com/linux/security/advisories/2007_4_sr.html
- http://www.osvdb.org/21906
- http://www.redhat.com/support/errata/RHSA-2007-0018.html
- http://www.securityfocus.com/archive/1/420098/100/0/threaded
- http://www.securityfocus.com/archive/1/435197/100/0/threaded
- http://www.securityfocus.com/bid/15987
- http://www.securityfocus.com/bid/19289
- http://www.trustix.org/errata/2006/0002/
- http://www.vupen.com/english/advisories/2005/2996
- http://www.vupen.com/english/advisories/2006/3101
- http://wwwnew.mandriva.com/security/advisories?name=MDKSA-2005:236
- https://exchange.xforce.ibmcloud.com/vulnerabilities/23713
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9659
- https://usn.ubuntu.com/233-1/