AusCERT - AA-2008.0136 -- [UNIX/Linux] -- fetchmail - Denial of Service vulnerabilities

HOME
About AusCERT
Membership
PKI Services
Publications
Sec. Bulletins
Conferences
News & Media
Services
Web Log
Site Map
Site Help
Member login
AA-2008.0136 -- [UNIX/Linux] -- fetchmail - Denial of Service vulnerabilities
Date: 18 June 2008
References: AU-2008.0014 ESB-2009.0147 ESB-2009.1271

Click here for printable version
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
AA-2008.0136                  AUSCERT Advisory

                               [UNIX/Linux]
               fetchmail - Denial of Service vulnerabilities
                               18 June 2008
- ---------------------------------------------------------------------------

        AusCERT Advisory Summary
        ------------------------

Product:              Prior to fetchmail 6.3.9
Operating System:     UNIX variants (UNIX, Linux, OSX)
Impact:               Denial of Service
Access:               Remote/Unauthenticated
CVE Names:            CVE-2007-4565 CVE-2008-2711
Member content until: Wednesday, July 16 2008

OVERVIEW

        A new version of fetchmail has been released to correct two security
        vulnerabilities.


IMPACT

        The National Vulnerability Database describes the vulnerabilities as:

        CVE-2007-4565

        fetchmail before 6.3.9 allows context-dependent attackers to cause a 
        denial of service (NULL dereference and application crash) by refusing 
        certain warning messages that are sent over SMTP. [1]

        CVE-2008-2711

        fetchmail 6.3.8 and earlier, when running in -v -v mode, allows remote 
        attackers to cause a denial of service (crash and persistent mail 
        failure) via a malformed mail message with long headers, which is not 
        properly handled when using vsnprintf to format log messages. [2]


MITIGATION

        Currently the only corrected version is in the Subversion Repository.

        This was corrected on 2008-06-13, revision 5193. See the security 
        advisory SA-2008-01 [3] for more details.


REFERENCES

        [1] National Vulnerability Database (CVE-2007-4565)
            http://nvd.nist.gov/nvd.cfm?cvename=cve-2007-4565

        [2] National Vulnerability Database (CVE-2008-2711)
            http://nvd.nist.gov/nvd.cfm?cvename=cve-2008-2711

        [3] Fetchmail Security Advisory SA-2008-01
            http://www.fetchmail.info/fetchmail-SA-2008-01.txt

AusCERT has made every effort to ensure that the information contained
in this document is accurate.  However, the decision to use the information
described is the responsibility of each user or organisation. The decision to
follow or act on information or advice contained in this security bulletin is
the responsibility of each user or organisation, and should be considered in
accordance with your organisation's site policies and procedures. AusCERT
takes no responsibility for consequences which may arise from following or
acting on information or advice contained in this security bulletin.

If you believe that your computer system has been compromised or attacked in 
any way, we encourage you to let us know by completing the secure National IT 
Incident Reporting Form at:

        http://www.auscert.org.au/render.html?it=3192

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================

-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQCVAwUBSFiK5Sh9+71yA2DNAQIXlwP/aRSpzZ6L4lHMTPwFj+zZaEmWVyNx+GUF
07AGX6EuhcbtUtnJVw7fsC9vlpF8RqoCBMF+Dlw/f8Y0PnwJNj2iygnHwrKdD98R
MoeXYbV11gnxfNpT4m5EVx75WP21TAfOMyFikT36LDGvygxlba1bmpFI9H5u3p+W
Isvk0KqoEWs=
=GJLL
-----END PGP SIGNATURE-----