Fetchmail POP3 Client Remote Denial of Service Vulnerabilities

Bugtraq ID:	14384
Class:	Failure to Handle Exceptional Conditions
CVE:
Remote:	Yes
Local:	No
Published:	Jul 26 2005 12:00AM
Updated:	Jul 26 2005 12:00AM
Credit:	The vendor reported these issues.
Vulnerable:	Eric Raymond Fetchmail 6.2.5 .1
Not Vulnerable:	Eric Raymond Fetchmail 6.2.6 -pre7 Eric Raymond Fetchmail 6.2.5 .2

Fetchmail POP3 Client Remote Denial of Service Vulnerabilities

Fetchmail is affected by multiple remote denial of service vulnerabilities.

These issues were introduced due to a fix that was released for BID 14349 (Fetchmail POP3 Client Buffer Overflow Vulnerability).

Specifically, malformed responses from a malicious server can cause the client to crash.

These issues affect Fetchmail 6.2.5.1.

Fetchmail POP3 Client Remote Denial of Service Vulnerabilities

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Fetchmail POP3 Client Remote Denial of Service Vulnerabilities

Solution:
The vendor has released an advisory, along with versions 6.2.5.2 and 6.2.6-pre7 to address these issues. Please see the referenced advisory for further information.


Eric Raymond Fetchmail 6.2.5 .1

• Eric Raymond fetchmail-patch-6.2.5.2.gz
  http://download.berlios.de/fetchmail/fetchmail-patch-6.2.5.2.gz

Fetchmail POP3 Client Remote Denial of Service Vulnerabilities

References:

• Fetchmail Homepage (Eric Raymond)
  
• fetchmail-SA-2005-01: security announcement (Fetchmail)
  
• fetchmail security announcement fetchmail-SA-2005-01 (Matthias Andree )