Fetchmail Buffer Overflow Vulnerability

Bugtraq ID:	2877
Class:	Boundary Condition Error
CVE:
Remote:	Yes
Local:	No
Published:	Jun 15 2001 12:00AM
Updated:	Jun 15 2001 12:00AM
Credit:	Discovered by Wolfram Kleff <[email protected]>.
Vulnerable:	Eric Raymond Fetchmail 5.8.6 - Apple Mac OS X 10.1 Eric Raymond Fetchmail 5.8.5 Eric Raymond Fetchmail 5.8.4 Eric Raymond Fetchmail 5.8.3 Eric Raymond Fetchmail 5.8.2 Eric Raymond Fetchmail 5.8.1 Eric Raymond Fetchmail 5.8 .0 + SuSE Linux 7.2 Eric Raymond Fetchmail 5.7.2 Eric Raymond Fetchmail 5.7.1 - Debian Linux 2.3 Eric Raymond Fetchmail 5.7 Eric Raymond Fetchmail 5.6.8 Eric Raymond Fetchmail 5.6.7 Eric Raymond Fetchmail 5.6.6 Eric Raymond Fetchmail 5.6.5 + SuSE Linux 7.1 x86 + SuSE Linux 7.1 sparc + SuSE Linux 7.1 ppc + SuSE Linux 7.1 alpha + SuSE Linux 7.1 Eric Raymond Fetchmail 5.6.4 Eric Raymond Fetchmail 5.6.3 Eric Raymond Fetchmail 5.6.2 Eric Raymond Fetchmail 5.6.1 Eric Raymond Fetchmail 5.6 Eric Raymond Fetchmail 5.5.6 Eric Raymond Fetchmail 5.5.5 Eric Raymond Fetchmail 5.5.4 Eric Raymond Fetchmail 5.5.3 Eric Raymond Fetchmail 5.5.2 Eric Raymond Fetchmail 5.5.1 Eric Raymond Fetchmail 5.5 + Cobalt Qube 3.0 - Immunix Immunix OS 7.0 beta - Immunix Immunix OS 7.0 Eric Raymond Fetchmail 5.4.5 Eric Raymond Fetchmail 5.4.4 Eric Raymond Fetchmail 5.4.3 Eric Raymond Fetchmail 5.4.2 Eric Raymond Fetchmail 5.4.1 Eric Raymond Fetchmail 5.4 .0 + Caldera OpenLinux Server 3.1.1 + Caldera OpenLinux Server 3.1 + Caldera OpenLinux Workstation 3.1.1 + Caldera OpenLinux Workstation 3.1 + EnGarde Secure Linux 1.0.1 - Guardian Digital Engarde Secure Linux 1.0.1 Eric Raymond Fetchmail 5.3.8 Eric Raymond Fetchmail 5.3.7 Eric Raymond Fetchmail 5.3.6 Eric Raymond Fetchmail 5.3.5 Eric Raymond Fetchmail 5.3.4 Eric Raymond Fetchmail 5.3.3 + Debian Linux 2.2 sparc + Debian Linux 2.2 powerpc + Debian Linux 2.2 IA-32 + Debian Linux 2.2 arm + Debian Linux 2.2 alpha + Debian Linux 2.2 68k Eric Raymond Fetchmail 5.3.2 Eric Raymond Fetchmail 5.3.1 - Immunix Immunix OS 6.2 Eric Raymond Fetchmail 5.3 Eric Raymond Fetchmail 5.2 - SCO eDesktop 2.4 Eric Raymond Fetchmail 5.1 Eric Raymond Fetchmail 5.0 - Caldera OpenLinux 2.3 - SCO eServer 2.3
Not Vulnerable:

Fetchmail Buffer Overflow Vulnerability

Solution:
Immunix, Debian, FreeBSD, Conectiva, Guardian Digital (Engarde Secure Linux) and Caldera have released advisories and upgraded packages.


Eric Raymond Fetchmail 5.0

• Caldera eServer 2.3.1 / ECential fo eBuilder 3.0 fetchmail-5.0.4-1.i386.rpm
  ftp://ftp.caldera.com/pub/updates/eServer/2.3/current/RPMS/fetchmail-5 .0.4-1.i386.rpm


• Caldera eServer 2.3/eBuilder for ECential 3.0 fetchmail-5.0.4-1.i386.rpm
  ftp://ftp.caldera.com/pub/updates/eServer/2.3/current/RPMS/fetchmail-5 .0.4-1.i386.rpm


• Caldera OpenLinux 2.3 fetchmail-5.0.4-1.i386.rpm
  ftp://ftp.caldera.com/pub/updates/OpenLinux/2.3/current/RPMS/fetchmail -5.0.4-1.i386.rpm


• Conectiva 4.0 fetchmail-5.0.0-5U40_1cl.i386.rpm
  ftp://atualizacoes.conectiva.com.br/4.0/i386/fetchmail-5.0.0-5U40_1cl. i386.rpm


• Conectiva 4.0 fetchmailconf-5.0.0-5U40_1cl.i386.rpm
  ftp://atualizacoes.conectiva.com.br/4.0/i386/fetchmailconf-5.0.0-5U40_ 1cl.i386.rpm


• Conectiva 4.0es fetchmail-5.0.0-5U40_1cl.i386.rpm
  ftp://atualizacoes.conectiva.com.br/4.0es/i386/fetchmail-5.0.0-5U40_1c l.i386.rpm


• Conectiva 4.0es fetchmailconf-5.0.0-5U40_1cl.i386.rpm
  ftp://atualizacoes.conectiva.com.br/4.0es/i386/fetchmailconf-5.0.0-5U4 0_1cl.i386.rpm


• Conectiva 4.1 fetchmail-5.0.0-6U41_1cl.i386.rpm
  ftp://atualizacoes.conectiva.com.br/4.1/i386/fetchmail-5.0.0-6U41_1cl. i386.rpm


• Conectiva 4.1 fetchmailconf-5.0.0-6U41_1cl.i386.rpm
  ftp://atualizacoes.conectiva.com.br/4.1/i386/fetchmailconf-5.0.0-6U41_ 1cl.i386.rpm


• Conectiva 4.2 fetchmail-5.0.0-6U42_1cl.i386.rpm
  ftp://atualizacoes.conectiva.com.br/4.2/i386/fetchmail-5.0.0-6U42_1cl. i386.rpm


• Conectiva 4.2 fetchmailconf-5.0.0-6U42_1cl.i386.rpm
  ftp://atualizacoes.conectiva.com.br/4.2/i386/fetchmailconf-5.0.0-6U42_ 1cl.i386.rpm

Eric Raymond Fetchmail 5.2

• Caldera eDesktop 2.4 fetchmail-5.2.0-2.i386.rpm
  ftp://ftp.caldera.com/pub/updates/eDesktop/2.4/current/RPMS/fetchmail- 5.2.0-2.i386.rpm

Eric Raymond Fetchmail 5.3.1

• Immunix 6.2 fetchmail-5.3.1-2_StackGuard.i386.rpm
  http://download.immunix.org/ImmunixOS/6.2/updates/RPMS/fetchmail-5.3.1 -2_StackGuard.i386.rpm


• Immunix 6.2 fetchmailconf-5.3.1-2_StackGuard.i386.rpm
  http://download.immunix.org/ImmunixOS/6.2/updates/RPMS/fetchmailconf-5 .3.1-2_StackGuard.i386.rpm

Eric Raymond Fetchmail 5.3.3

• Debian 2.2 alpha fetchmail_5.3.3-1.2_alpha.deb
  http://security.debian.org/dists/stable/updates/main/binary-alpha/fetc hmail_5.3.3-1.2_alpha.deb


• Debian 2.2 arm fetchmail_5.3.3-1.2_arm.deb
  http://security.debian.org/dists/stable/updates/main/binary-arm/fetchm ail_5.3.3-1.2_arm.deb


• Debian 2.2 i386 fetchmail_5.3.3-1.2_i386.deb
  http://security.debian.org/dists/stable/updates/main/binary-i386/fetch mail_5.3.3-1.2_i386.deb


• Debian 2.2 m68k fetchmail_5.3.3-1.2_m68k.deb
  http://security.debian.org/dists/stable/updates/main/binary-m68k/fetch mail_5.3.3-1.2_m68k.deb


• Debian 2.2 ppc fetchmail_5.3.3-1.2_powerpc.deb
  http://security.debian.org/dists/stable/updates/main/binary-powerpc/fe tchmail_5.3.3-1.2_powerpc.deb


• Debian 2.2 sparc fetchmail_5.3.3-1.2_sparc.deb
  http://security.debian.org/dists/stable/updates/main/binary-sparc/fetc hmail_5.3.3-1.2_sparc.deb

Eric Raymond Fetchmail 5.4 .0

• Caldera OpenLinux 3.1 Server fetchmail-5.4.0-5a.i386.rpm
  ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1/Server/current/RPMS/fe tchmail-5.4.0-5a.i386.rpm


• Caldera OpenLinux 3.1 Server fetchmailconf-5.4.0-5a.i386.rpm
  ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1/Server/current/RPMS/fe tchmailconf-5.4.0-5a.i386.rpm


• Caldera OpenLinux 3.1 Workstation fetchmail-5.4.0-5a.i386.rpm
  ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1/Workstation/current/RP MS/fetchmail-5.4.0-5a.i386.rpm


• Caldera OpenLinux 3.1 Workstation fetchmailconf-5.4.0-5a.i386.rpm
  ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1/Workstation/current/RP MS/fetchmailconf-5.4.0-5a.i386.rpm


• EnGarde Secure Linux 1.0.1 i386 fetchmail-ssl-5.8.7-1.0.2.i386.rpm
  http://ftp.ibiblio.org/pub/linux/distributions/engarde/stable/updates/ i386/fetchmail-ssl-5.8.7-1.0.2.i386.rpm


• EnGarde Secure Linux 1.0.1 i686 fetchmail-ssl-5.8.7-1.0.2.i686.rpm
  http://ftp.ibiblio.org/pub/linux/distributions/engarde/stable/updates/ i686/fetchmail-ssl-5.8.7-1.0.2.i686.rpm

Eric Raymond Fetchmail 5.5

• Immunix 7.0/7.0-beta fetchmail-5.5.0-4_imnx.i386.rpm
  http://download.immunix.org/ImmunixOS/7.0/updates/RPMS/fetchmail-5.5.0 -4_imnx.i386.rpm


• Immunix 7.0/7.0-beta fetchmailconf-5.5.0-4_imnx.i386.rpm
  http://download.immunix.org/ImmunixOS/7.0/updates/RPMS/fetchmailconf-5 .5.0-4_imnx.i386.rpm

Eric Raymond Fetchmail 5.5.5

• Conectiva 5.0 fetchmail-5.5.5-2U50_1cl.i386.rpm
  ftp://atualizacoes.conectiva.com.br/5.0/i386/fetchmail-5.5.5-2U50_1cl. i386.rpm


• Conectiva 5.0 fetchmailconf-5.5.5-2U50_1cl.i386.rpm
  ftp://atualizacoes.conectiva.com.br/5.0/i386/fetchmailconf-5.5.5-2U50_ 1cl.i386.rpm


• Conectiva 5.1 fetchmail-5.5.5-2U51_1cl.i386.rpm
  ftp://atualizacoes.conectiva.com.br/5.1/i386/fetchmail-5.5.5-2U51_1cl. i386.rpm


• Conectiva 5.1 fetchmailconf-5.5.5-2U51_1cl.i386.rpm
  ftp://atualizacoes.conectiva.com.br/5.1/i386/fetchmailconf-5.5.5-2U51_ 1cl.i386.rpm


• Conectiva 6.0 fetchmail-5.5.5-2U60_1cl.i386.rpm
  ftp://atualizacoes.conectiva.com.br/6.0/RPMS/fetchmail-5.5.5-2U60_1cl. i386.rpm


• Conectiva 6.0 fetchmailconf-5.5.5-2U60_1cl.i386.rpm
  ftp://atualizacoes.conectiva.com.br/6.0/RPMS/fetchmailconf-5.5.5-2U60_ 1cl.i386.rpm


• Conectiva ecommerce fetchmail-5.5.5-2U50_1cl.i386.rpm
  ftp://atualizacoes.conectiva.com.br/ferramentas/ecommerce/i386/fetchma il-5.5.5-2U50_1cl.i386.rpm


• Conectiva ecommerce fetchmailconf-5.5.5-2U50_1cl.i386.rpm
  ftp://atualizacoes.conectiva.com.br/ferramentas/ecommerce/i386/fetchma ilconf-5.5.5-2U50_1cl.i386.rpm


• Conectiva graficas fetchmail-5.5.5-2U50_1cl.i386.rpm
  ftp://atualizacoes.conectiva.com.br/ferramentas/graficas/i386/fetchmai l-5.5.5-2U50_1cl.i386.rpm


• Conectiva graficas fetchmailconf-5.5.5-2U50_1cl.i386.rpm
  ftp://atualizacoes.conectiva.com.br/ferramentas/graficas/i386/fetchmai lconf-5.5.5-2U50_1cl.i386.rpm

Eric Raymond Fetchmail 5.7.1

• Debian 2.2 fetchmail-5.7.1-2.diff
  http://www.securityfocus.com/data/vulnerabilities/patches/fetchmail-5. 7.1-2.diff

Eric Raymond Fetchmail 5.8.6

• FreeBSD packages-4-stable mail fetchmail-5.8.6.tgz
  ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-4-stable/mail/fe tchmail-5.8.6.tgz


• FreeBSD packages-5-current mail fetchmail-5.8.6.tgz
  ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/i386/packages-5-current/mail/f etchmail-5.8.6.tgz