-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                       ESB-2007.0008 -- [UNIX/Linux]
           fetchmail security announcements 2006-02 and 2006-03
                              8 January 2007

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:              fetchmail 6.3.5 and prior
Publisher:            Matthias Andree
Operating System:     UNIX variants (UNIX, Linux, OSX)
Impact:               Access Privileged Data
                      Inappropriate Access
                      Denial of Service
Access:               Remote/Unauthenticated
CVE Names:            CVE-2006-5867 CVE-2006-5974

Comment: This bulletin contains two separate fetchmail security advisories,
         covering authentication and password disclosure vulnerabilities and
         a denial of service.

- --------------------------BEGIN INCLUDED TEXT--------------------

- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

fetchmail-SA-2006-02: TLS enforcement problem/MITM attack/password exposure

Topics:		fetchmail cannot enforce TLS

Author:		Matthias Andree
Version:	1.0
Announced:	2007-01-04
Type:		secret information disclosure
Impact:		fetchmail can expose cleartext password over unsecure link
		fetchmail may not detect man in the middle attacks
Danger:		medium
Credits:	Isaac Wilcox (bug report, testing, collaboration on fix)
CVE Name:	CVE-2006-5867
URL:		http://fetchmail.berlios.de/fetchmail-SA-2006-02.txt
Project URL:	http://fetchmail.berlios.de/

Affects:	fetchmail releases <= 6.3.5
		fetchmail release candidates 6.3.6-rc1, -rc2, -rc3

Not affected:	fetchmail release candidates 6.3.6-rc4, -rc5
		fetchmail release 6.3.6

Corrected:	2006-11-26 fetchmail 6.3.6-rc4


0. Release history
==================

2006-11-16	v0.01 internal review draft
2006-11-26	v0.02 revise failure cases, workaround, add acknowledgments
2006-11-27	v0.03 add more vulnerabilities
2006-01-04	v1.0  ready for release


1. Background
=============

fetchmail is a software package to retrieve mail from remote POP2, POP3,
IMAP, ETRN or ODMR servers and forward it to local SMTP, LMTP servers or
message delivery agents.

fetchmail ships with a graphical, Python/Tkinter based configuration
utility named "fetchmailconf" to help the user create configuration (run
control) files for fetchmail.


2. Problem description and Impact
=================================

Fetchmail has had several nasty password disclosure vulnerabilities for
a long time. It was only recently that these have been found.

V1. sslcertck/sslfingerprint options should have implied "sslproto tls1"
    in order to enforce TLS negotiation, but did not.

V2. Even with "sslproto tls1" in the config, fetches would go ahead
    in plain text if STLS/STARTTLS wasn't available (not advertised,
    or advertised but rejected).

V3. POP3 fetches could completely ignore all TLS options whether
    available or not because it didn't reliably issue CAPA before
    checking for STLS support - but CAPA is a requisite for STLS.
    Whether or not CAPAbilities were probed, depended on the "auth"
    option. (Fetchmail only tried CAPA if the auth option was not set at
    all, was set to gssapi, kerberos, kerberos_v4, otp, or cram-md5.)

V4. POP3 could fall back to using plain text passwords, even if strong
    authentication had been configured.

V5. POP2 would not complain if strong authentication or TLS had been
    requested.

This can cause eavesdroppers to obtain the password, depending on the
authentication scheme that is configured or auto-selected, and
subsequently impersonate somebody else when logging into the upstream
server.


3. Workaround
=============

If your upstream offers SSLv3-wrapped service on a dedicated port,
use   fetchmail --ssl --sslcertck --sslproto ssl3   on the command line,
or equivalent in the run control file.  This encrypts the whole session.


4. Solution
===========

Download and install fetchmail 6.3.6 or a newer stable release from
fetchmail's project site at
<http://developer.berlios.de/project/showfiles.php?group_id=1824>.


5. Acknowledgments
==================

Isaac Wilcox has been a great help with testing the fixes and getting
them right.


A. Copyright, License and Warranty
==================================

(C) Copyright 2007 by Matthias Andree, <matthias.andree@gmx.de>.
Some rights reserved.

This work is licensed under the Creative Commons
Attribution-NonCommercial-NoDerivs German License. To view a copy of
this license, visit http://creativecommons.org/licenses/by-nc-nd/2.0/de/
or send a letter to Creative Commons; 559 Nathan Abbott Way;
Stanford, California 94305; USA.

THIS WORK IS PROVIDED FREE OF CHARGE AND WITHOUT ANY WARRANTIES.
Use the information herein at your own risk.

END OF fetchmail-SA-2006-02.txt
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (GNU/Linux)

iD8DBQFFntnPvmGDOQUufZURAkSyAJ9JUbwIAGcN57VfuTgBMx2n525EGwCgnSpn
SxZtELCDVLRkrE4pKNlPGC0=
=MzBB
- -----END PGP SIGNATURE-----


- ----------------------------------------------------------------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

fetchmail-SA-2006-03: crash when refusing message delivered through MDA

Topics:		fetchmail crashes when refusing a message bound for an MDA

Author:		Matthias Andree
Version:	1.0
Announced:	2007-01-04
Type:		denial of service
Impact:		fetchmail aborts prematurely
Danger:		low
Credits:	Neil Hoggarth (bug report and analysis)
CVE Name:	CVE-2006-5974
URL:		http://fetchmail.berlios.de/fetchmail-SA-2006-03.txt
Project URL:	http://fetchmail.berlios.de/

Affects:	fetchmail release = 6.3.5
		fetchmail release candidates 6.3.6-rc1, -rc2

Not affected:	fetchmail release 6.3.6

Corrected:	2006-11-14 fetchmail SVN


0. Release history
==================

2006-11-19 -	internal review draft
2007-01-04 1.0	 ready for release


1. Background
=============

fetchmail is a software package to retrieve mail from remote POP2, POP3,
IMAP, ETRN or ODMR servers and forward it to local SMTP, LMTP servers or
message delivery agents.

fetchmail ships with a graphical, Python/Tkinter based configuration
utility named "fetchmailconf" to help the user create configuration (run
control) files for fetchmail.


2. Problem description and Impact
=================================

Fetchmail 6.3.5 and early 6.3.6 release candidates, when delivering
messages to a message delivery agent by means of the "mda" option, can
crash (by passing a NULL pointer to ferror() and fflush()) when refusing
a message. SMTP and LMTP delivery modes aren't affected.


3. Workaround
=============

Avoid the mda option and ship to a local SMTP or LMTP server instead.


4. Solution
===========

Download and install fetchmail 6.3.6 or a newer stable release from
fetchmail's project site at
<http://developer.berlios.de/project/showfiles.php?group_id=1824>.



A. Copyright, License and Warranty
==================================

(C) Copyright 2007 by Matthias Andree, <matthias.andree@gmx.de>.
Some rights reserved.

This work is licensed under the Creative Commons
Attribution-NonCommercial-NoDerivs German License. To view a copy of
this license, visit http://creativecommons.org/licenses/by-nc-nd/2.0/de/
or send a letter to Creative Commons; 559 Nathan Abbott Way;
Stanford, California 94305; USA.

THIS WORK IS PROVIDED FREE OF CHARGE AND WITHOUT ANY WARRANTIES.
Use the information herein at your own risk.

END OF fetchmail-SA-2006-03.txt
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (GNU/Linux)

iD8DBQFFntntvmGDOQUufZURAicZAKCg2UcpAQ0Wot44RbXYLP082rEX5QCfUYxg
qPVbKSzqv4ZEgrimsGieYc8=
=JbTf
- -----END PGP SIGNATURE-----

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        http://www.auscert.org.au/render.html?cid=1980

If you believe that your computer system has been compromised or attacked in 
any way, we encourage you to let us know by completing the secure National IT 
Incident Reporting Form at:

        http://www.auscert.org.au/render.html?it=3192

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================

-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQCVAwUBRaHAryh9+71yA2DNAQLzhwP6Ay7T03gXNucVP7dw0rrT4+Rw6Gjqd4r8
WQBy9JT8Pf6XSXQ+C1w288UHBwVibjxsfvQhBFZtTGxOqCJL6Dq4zQT5IuJmh4Ig
2mTm03drR16DkKaoQkueUdPT9ENEYyR/PooYRt3Jbxujwy29ngHxQu3CSohyTwlO
JLfKnIqbfyg=
=1hbw
-----END PGP SIGNATURE-----