Fetchmail NULL Character CA SSL Certificate Validation Security Bypass Vulnerability

Bugtraq ID:	35951
Class:	Design Error
CVE:	CVE-2009-2666
Remote:	Yes
Local:	No
Published:	Aug 05 2009 12:00AM
Updated:	Apr 13 2015 10:16PM
Credit:	Matthias Andree
Vulnerable:	Ubuntu Ubuntu Linux 9.04 sparc Ubuntu Ubuntu Linux 9.04 powerpc Ubuntu Ubuntu Linux 9.04 lpia Ubuntu Ubuntu Linux 9.04 i386 Ubuntu Ubuntu Linux 9.04 amd64 Ubuntu Ubuntu Linux 8.10 sparc Ubuntu Ubuntu Linux 8.10 powerpc Ubuntu Ubuntu Linux 8.10 lpia Ubuntu Ubuntu Linux 8.10 i386 Ubuntu Ubuntu Linux 8.10 amd64 Ubuntu Ubuntu Linux 8.04 LTS sparc Ubuntu Ubuntu Linux 8.04 LTS powerpc Ubuntu Ubuntu Linux 8.04 LTS lpia Ubuntu Ubuntu Linux 8.04 LTS i386 Ubuntu Ubuntu Linux 8.04 LTS amd64 Ubuntu Ubuntu Linux 6.06 LTS sparc Ubuntu Ubuntu Linux 6.06 LTS powerpc Ubuntu Ubuntu Linux 6.06 LTS i386 Ubuntu Ubuntu Linux 6.06 LTS amd64 Slackware Linux 10.2 Slackware Linux 10.1 Slackware Linux 10.0 Slackware Linux 9.1 Slackware Linux 9.0 Slackware Linux 8.1 Slackware Linux 12.2 Slackware Linux 12.1 Slackware Linux 12.0 Slackware Linux 11.0 Slackware Linux -current Redhat Enterprise Linux WS 4 Redhat Enterprise Linux WS 3 Redhat Enterprise Linux ES 4 Redhat Enterprise Linux ES 3 Redhat Enterprise Linux Desktop Workstation 5 client Redhat Enterprise Linux AS 4 Redhat Enterprise Linux AS 3 Redhat Enterprise Linux Desktop version 4 Redhat Enterprise Linux 5 Server Redhat Desktop 3.0 Mandriva Linux Mandrake 2009.1 x86_64 Mandriva Linux Mandrake 2009.1 Mandriva Linux Mandrake 2009.0 x86_64 Mandriva Linux Mandrake 2009.0 Mandriva Linux Mandrake 2008.1 x86_64 Mandriva Linux Mandrake 2008.1 Mandriva Linux Mandrake 2008.0 x86_64 Mandriva Linux Mandrake 2008.0 MandrakeSoft Enterprise Server 5 x86_64 MandrakeSoft Enterprise Server 5 MandrakeSoft Corporate Server 4.0 x86_64 MandrakeSoft Corporate Server 3.0 x86_64 MandrakeSoft Corporate Server 3.0 MandrakeSoft Corporate Server 4.0 Gentoo Linux Eric Raymond Fetchmail 6.3.10 Eric Raymond Fetchmail 6.3.8 Eric Raymond Fetchmail 6.3.6 Eric Raymond Fetchmail 6.3.5 Eric Raymond Fetchmail 6.3.2 rc4 Eric Raymond Fetchmail 6.3.2 rc3 Eric Raymond Fetchmail 6.3.2 rc2 Eric Raymond Fetchmail 6.3.2 Eric Raymond Fetchmail 6.3.1 -rc1 Eric Raymond Fetchmail 6.3.1 Eric Raymond Fetchmail 6.3 .0 Eric Raymond Fetchmail 6.3 Eric Raymond Fetchmail 6.2.9 -rc6 Eric Raymond Fetchmail 6.2.6 -pre7 Eric Raymond Fetchmail 6.2.5 .5 Eric Raymond Fetchmail 6.2.5 .4 Eric Raymond Fetchmail 6.2.5 .2 Eric Raymond Fetchmail 6.2.5 .1 Eric Raymond Fetchmail 6.2.5 Eric Raymond Fetchmail 6.2.4 Eric Raymond Fetchmail 6.2.2 Eric Raymond Fetchmail 6.2 .0 Eric Raymond Fetchmail 6.1.3 + OpenPKG OpenPKG Current Eric Raymond Fetchmail 6.1 .0 + EnGarde Secure Linux 1.0.1 + MandrakeSoft Corporate Server 2.1 x86_64 + MandrakeSoft Corporate Server 2.1 + MandrakeSoft Single Network Firewall 7.2 + Mandriva Linux Mandrake 9.0 + Mandriva Linux Mandrake 8.2 + Mandriva Linux Mandrake 8.1 + Mandriva Linux Mandrake 8.0 + Mandriva Linux Mandrake 7.2 Eric Raymond Fetchmail 6.0 .0 Eric Raymond Fetchmail 6.3.6-rc4 Eric Raymond Fetchmail 6.3.6-rc3 Eric Raymond Fetchmail 6.3.6-rc2 Eric Raymond Fetchmail 6.3.6-rc1 Eric Raymond Fetchmail 6.3.2 rc1 Debian Linux 5.0 sparc Debian Linux 5.0 s/390 Debian Linux 5.0 powerpc Debian Linux 5.0 mipsel Debian Linux 5.0 mips Debian Linux 5.0 m68k Debian Linux 5.0 ia-64 Debian Linux 5.0 ia-32 Debian Linux 5.0 hppa Debian Linux 5.0 armel Debian Linux 5.0 arm Debian Linux 5.0 amd64 Debian Linux 5.0 alpha Debian Linux 5.0 Debian Linux 4.0 sparc Debian Linux 4.0 s/390 Debian Linux 4.0 powerpc Debian Linux 4.0 mipsel Debian Linux 4.0 mips Debian Linux 4.0 m68k Debian Linux 4.0 ia-64 Debian Linux 4.0 ia-32 Debian Linux 4.0 hppa Debian Linux 4.0 armel Debian Linux 4.0 arm Debian Linux 4.0 amd64 Debian Linux 4.0 alpha Debian Linux 4.0 Apple Mac OS X Server 10.6.1 Apple Mac OS X Server 10.5.8 Apple Mac OS X Server 10.5.7 Apple Mac OS X Server 10.5.6 Apple Mac OS X Server 10.5.5 Apple Mac OS X Server 10.5.4 Apple Mac OS X Server 10.5.3 Apple Mac OS X Server 10.5.2 Apple Mac OS X Server 10.5.1 Apple Mac OS X Server 10.4.11 Apple Mac OS X Server 10.4.10 Apple Mac OS X Server 10.4.9 Apple Mac OS X Server 10.4.8 Apple Mac OS X Server 10.4.7 Apple Mac OS X Server 10.4.6 Apple Mac OS X Server 10.4.5 Apple Mac OS X Server 10.4.4 Apple Mac OS X Server 10.4.3 Apple Mac OS X Server 10.4.2 Apple Mac OS X Server 10.4.1 Apple Mac OS X Server 10.4 Apple Mac OS X Server 10.3.9 Apple Mac OS X Server 10.3.8 Apple Mac OS X Server 10.3.7 Apple Mac OS X Server 10.3.6 Apple Mac OS X Server 10.3.5 Apple Mac OS X Server 10.3.4 Apple Mac OS X Server 10.3.3 Apple Mac OS X Server 10.3.2 Apple Mac OS X Server 10.3.1 Apple Mac OS X Server 10.3 Apple Mac OS X Server 10.6 Apple Mac OS X Server 10.5 Apple Mac OS X 10.6.1 Apple Mac OS X 10.5.8 Apple Mac OS X 10.5.7 Apple Mac OS X 10.5.6 Apple Mac OS X 10.5.5 Apple Mac OS X 10.5.4 Apple Mac OS X 10.5.3 Apple Mac OS X 10.5.2 Apple Mac OS X 10.5.1 Apple Mac OS X 10.4.11 Apple Mac OS X 10.4.10 Apple Mac OS X 10.4.9 Apple Mac OS X 10.4.8 Apple Mac OS X 10.4.7 Apple Mac OS X 10.4.6 Apple Mac OS X 10.4.5 Apple Mac OS X 10.4.4 Apple Mac OS X 10.4.3 Apple Mac OS X 10.4.2 Apple Mac OS X 10.4.1 Apple Mac OS X 10.4 Apple Mac OS X 10.3.9 Apple Mac OS X 10.3.8 Apple Mac OS X 10.3.7 Apple Mac OS X 10.3.6 Apple Mac OS X 10.3.5 Apple Mac OS X 10.3.4 Apple Mac OS X 10.3.3 Apple Mac OS X 10.3.2 Apple Mac OS X 10.3.1 Apple Mac OS X 10.3 Apple Mac OS X 10.6 Apple Mac OS X 10.5
Not Vulnerable:	Eric Raymond Fetchmail 6.3.11 Apple Mac OS X Server 10.6.2 Apple Mac OS X 10.6.2

Fetchmail NULL Character CA SSL Certificate Validation Security Bypass Vulnerability

Fetchmail is prone to a security-bypass vulnerability because the application fails to properly validate the domain name in a signed CA certificate, allowing attackers to substitute malicious SSL certificates for trusted ones.

Successfully exploiting this issue allows attackers to perform man-in-the-middle attacks or impersonate trusted servers, which will aid in further attacks.

Versions prior to Fetchmail 6.3.11 are vulnerable.

Fetchmail NULL Character CA SSL Certificate Validation Security Bypass Vulnerability

Attackers use man-in-the-middle attacks to exploit this issue.

Fetchmail NULL Character CA SSL Certificate Validation Security Bypass Vulnerability

Solution:
Updates are available. Please see the references for more information.


Ubuntu Ubuntu Linux 8.10 powerpc

• Ubuntu fetchmail_6.3.8-11ubuntu3.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/f/fetchmail/fetchmail_6.3.8-11ubuntu 3.1_powerpc.deb


• Ubuntu fetchmailconf_6.3.8-11ubuntu3.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/universe/f/fetchmail/fetchmailc onf_6.3.8-11ubuntu3.1_all.deb

Slackware Linux 12.2

• Slackware fetchmail-6.3.11-i486-1_slack12.2.tgz
  ftp://ftp.slackware.com/pub/slackware/slackware-12.2/patches/packages/ fetchmail-6.3.11-i486-1_slack12.2.tgz

Debian Linux 5.0 alpha

• Debian fetchmail_6.3.9~rc2-4+lenny1_alpha.deb
  http://security.debian.org/pool/updates/main/f/fetchmail/fetchmail_6.3 .9~rc2-4+lenny1_alpha.deb


• Debian fetchmailconf_6.3.9~rc2-4+lenny1_all.deb
  http://security.debian.org/pool/updates/main/f/fetchmail/fetchmailconf _6.3.9~rc2-4+lenny1_all.deb

Mandriva Linux Mandrake 2008.0

• Mandriva fetchmail-6.3.8-4.2mdv2008.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva fetchmail-daemon-6.3.8-4.2mdv2008.0.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva fetchmailconf-6.3.8-4.2mdv2008.0.i586.rpm
  http://www.mandriva.com/en/download/

Ubuntu Ubuntu Linux 9.04 sparc

• Ubuntu fetchmail_6.3.9~rc2-4ubuntu1.1_sparc.deb
  http://ports.ubuntu.com/pool/main/f/fetchmail/fetchmail_6.3.9~rc2-4ubu ntu1.1_sparc.deb


• Ubuntu fetchmailconf_6.3.9~rc2-4ubuntu1.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/universe/f/fetchmail/fetchmailc onf_6.3.9~rc2-4ubuntu1.1_all.deb

Debian Linux 4.0 amd64

• Debian fetchmail_6.3.6-1etch2_amd64.deb
  http://security.debian.org/pool/updates/main/f/fetchmail/fetchmail_6.3 .6-1etch2_amd64.deb


• Debian fetchmailconf_6.3.6-1etch2_all.deb
  http://security.debian.org/pool/updates/main/f/fetchmail/fetchmailconf _6.3.6-1etch2_all.deb

Debian Linux 4.0 ia-32

• Debian fetchmail_6.3.6-1etch2_i386.deb
  http://security.debian.org/pool/updates/main/f/fetchmail/fetchmail_6.3 .6-1etch2_i386.deb


• Debian fetchmailconf_6.3.6-1etch2_all.deb
  http://security.debian.org/pool/updates/main/f/fetchmail/fetchmailconf _6.3.6-1etch2_all.deb

Eric Raymond Fetchmail 6.3.6-rc1

• Eric Raymond fetchmail-6.3.11.tar.bz2
  http://prdownload.berlios.de/fetchmail/fetchmail-6.3.11.tar.bz2

Ubuntu Ubuntu Linux 8.10 sparc

• Ubuntu fetchmail_6.3.8-11ubuntu3.1_sparc.deb
  http://ports.ubuntu.com/pool/main/f/fetchmail/fetchmail_6.3.8-11ubuntu 3.1_sparc.deb


• Ubuntu fetchmailconf_6.3.8-11ubuntu3.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/universe/f/fetchmail/fetchmailc onf_6.3.8-11ubuntu3.1_all.deb

Ubuntu Ubuntu Linux 9.04 lpia

• Ubuntu fetchmail_6.3.9~rc2-4ubuntu1.1_lpia.deb
  http://ports.ubuntu.com/pool/main/f/fetchmail/fetchmail_6.3.9~rc2-4ubu ntu1.1_lpia.deb


• Ubuntu fetchmailconf_6.3.9~rc2-4ubuntu1.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/universe/f/fetchmail/fetchmailc onf_6.3.9~rc2-4ubuntu1.1_all.deb

Debian Linux 5.0 armel

• Debian fetchmail_6.3.9~rc2-4+lenny1_armel.deb
  http://security.debian.org/pool/updates/main/f/fetchmail/fetchmail_6.3 .9~rc2-4+lenny1_armel.deb


• Debian fetchmailconf_6.3.9~rc2-4+lenny1_all.deb
  http://security.debian.org/pool/updates/main/f/fetchmail/fetchmailconf _6.3.9~rc2-4+lenny1_all.deb

Eric Raymond Fetchmail 6.3.2 rc1

• Eric Raymond fetchmail-6.3.11.tar.bz2
  http://prdownload.berlios.de/fetchmail/fetchmail-6.3.11.tar.bz2

Apple Mac OS X 10.6

• Apple MacOSXUpdCombo10.6.2.dmg
  For Mac OS X v10.6
  http://www.apple.com/support/downloads/

Mandriva Linux Mandrake 2009.0 x86_64

• Mandriva fetchmail-6.3.8-8.1mdv2009.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva fetchmail-daemon-6.3.8-8.1mdv2009.0.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva fetchmailconf-6.3.8-8.1mdv2009.0.x86_64.rpm
  http://www.mandriva.com/en/download/

Debian Linux 5.0 mips

• Debian fetchmail_6.3.9~rc2-4+lenny1_mips.deb
  http://security.debian.org/pool/updates/main/f/fetchmail/fetchmail_6.3 .9~rc2-4+lenny1_mips.deb


• Debian fetchmailconf_6.3.9~rc2-4+lenny1_all.deb
  http://security.debian.org/pool/updates/main/f/fetchmail/fetchmailconf _6.3.9~rc2-4+lenny1_all.deb

Ubuntu Ubuntu Linux 9.04 amd64

• Ubuntu fetchmail_6.3.9~rc2-4ubuntu1.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/f/fetchmail/fetchmail_6.3. 9~rc2-4ubuntu1.1_amd64.deb


• Ubuntu fetchmailconf_6.3.9~rc2-4ubuntu1.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/universe/f/fetchmail/fetchmailc onf_6.3.9~rc2-4ubuntu1.1_all.deb

Debian Linux 4.0 mips

• Debian fetchmailconf_6.3.6-1etch2_all.deb
  http://security.debian.org/pool/updates/main/f/fetchmail/fetchmailconf _6.3.6-1etch2_all.deb

Debian Linux 5.0 sparc

• Debian fetchmail_6.3.9~rc2-4+lenny1_sparc.deb
  http://security.debian.org/pool/updates/main/f/fetchmail/fetchmail_6.3 .9~rc2-4+lenny1_sparc.deb


• Debian fetchmailconf_6.3.9~rc2-4+lenny1_all.deb
  http://security.debian.org/pool/updates/main/f/fetchmail/fetchmailconf _6.3.9~rc2-4+lenny1_all.deb

Mandriva Linux Mandrake 2008.1 x86_64

• Mandriva fetchmail-6.3.8-7.2mdv2008.1.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva fetchmail-daemon-6.3.8-7.2mdv2008.1.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva fetchmailconf-6.3.8-7.2mdv2008.1.x86_64.rpm
  http://www.mandriva.com/en/download/

Debian Linux 4.0 arm

• Debian fetchmail_6.3.6-1etch2_arm.deb
  http://security.debian.org/pool/updates/main/f/fetchmail/fetchmail_6.3 .6-1etch2_arm.deb


• Debian fetchmailconf_6.3.6-1etch2_all.deb
  http://security.debian.org/pool/updates/main/f/fetchmail/fetchmailconf _6.3.6-1etch2_all.deb

Mandriva Linux Mandrake 2008.1

• Mandriva fetchmail-6.3.8-7.2mdv2008.1.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva fetchmail-daemon-6.3.8-7.2mdv2008.1.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva fetchmailconf-6.3.8-7.2mdv2008.1.i586.rpm
  http://www.mandriva.com/en/download/

Mandriva Linux Mandrake 2009.1 x86_64

• Mandriva fetchmail-6.3.9-1.1mdv2009.1.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva fetchmail-daemon-6.3.9-1.1mdv2009.1.x86_64.rpm
  http://www.mandriva.com/en/download/


• Mandriva fetchmailconf-6.3.9-1.1mdv2009.1.x86_64.rpm
  http://www.mandriva.com/en/download/

Eric Raymond Fetchmail 6.3.6-rc2

• Eric Raymond fetchmail-6.3.11.tar.bz2
  http://prdownload.berlios.de/fetchmail/fetchmail-6.3.11.tar.bz2

Eric Raymond Fetchmail 6.3.6-rc4

• Eric Raymond fetchmail-6.3.11.tar.bz2
  http://prdownload.berlios.de/fetchmail/fetchmail-6.3.11.tar.bz2

Debian Linux 4.0 powerpc

• Debian fetchmail_6.3.6-1etch2_powerpc.deb
  http://security.debian.org/pool/updates/main/f/fetchmail/fetchmail_6.3 .6-1etch2_powerpc.deb


• Debian fetchmailconf_6.3.6-1etch2_all.deb
  http://security.debian.org/pool/updates/main/f/fetchmail/fetchmailconf _6.3.6-1etch2_all.deb

Ubuntu Ubuntu Linux 8.10 i386

• Ubuntu fetchmail_6.3.8-11ubuntu3.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/f/fetchmail/fetchmail_6.3. 8-11ubuntu3.1_i386.deb


• Ubuntu fetchmailconf_6.3.8-11ubuntu3.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/universe/f/fetchmail/fetchmailc onf_6.3.8-11ubuntu3.1_all.deb

Debian Linux 4.0 m68k

• Debian fetchmailconf_6.3.6-1etch2_all.deb
  http://security.debian.org/pool/updates/main/f/fetchmail/fetchmailconf _6.3.6-1etch2_all.deb

MandrakeSoft Enterprise Server 5

• Mandriva fetchmail-6.3.8-8.1mdvmes5.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva fetchmail-daemon-6.3.8-8.1mdvmes5.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva fetchmailconf-6.3.8-8.1mdvmes5.i586.rpm
  http://www.mandriva.com/en/download/

Debian Linux 5.0 s/390

• Debian fetchmail_6.3.9~rc2-4+lenny1_s390.deb
  http://security.debian.org/pool/updates/main/f/fetchmail/fetchmail_6.3 .9~rc2-4+lenny1_s390.deb


• Debian fetchmailconf_6.3.9~rc2-4+lenny1_all.deb
  http://security.debian.org/pool/updates/main/f/fetchmail/fetchmailconf _6.3.9~rc2-4+lenny1_all.deb

Ubuntu Ubuntu Linux 8.04 LTS lpia

• Ubuntu fetchmail_6.3.8-10ubuntu1.1_lpia.deb
  http://ports.ubuntu.com/pool/main/f/fetchmail/fetchmail_6.3.8-10ubuntu 1.1_lpia.deb


• Ubuntu fetchmailconf_6.3.8-10ubuntu1.1_all.deb
  http://security.ubuntu.com/ubuntu/pool/universe/f/fetchmail/fetchmailc onf_6.3.8-10ubuntu1.1_all.deb

Ubuntu Ubuntu Linux 6.06 LTS i386

• Ubuntu fetchmail_6.3.2-2ubuntu2.3_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/f/fetchmail/fetchmail_6.3. 2-2ubuntu2.3_i386.deb


• Ubuntu fetchmailconf_6.3.2-2ubuntu2.3_all.deb
  http://security.ubuntu.com/ubuntu/pool/universe/f/fetchmail/fetchmailc onf_6.3.2-2ubuntu2.3_all.deb

Debian Linux 5.0 hppa

• Debian fetchmail_6.3.9~rc2-4+lenny1_hppa.deb
  http://security.debian.org/pool/updates/main/f/fetchmail/fetchmail_6.3 .9~rc2-4+lenny1_hppa.deb


• Debian fetchmailconf_6.3.9~rc2-4+lenny1_all.deb
  http://security.debian.org/pool/updates/main/f/fetchmail/fetchmailconf _6.3.9~rc2-4+lenny1_all.deb

Slackware Linux 10.0

• Slackware fetchmail-6.3.11-i486-1_slack10.0.tgz
  ftp://ftp.slackware.com/pub/slackware/slackware-10.0/patches/packages/ fetchmail-6.3.11-i486-1_slack10.0.tgz

Slackware Linux 10.2

• Slackware fetchmail-6.3.11-i486-1_slack10.2.tgz
  ftp://ftp.slackware.com/pub/slackware/slackware-10.2/patches/packages/ fetchmail-6.3.11-i486-1_slack10.2.tgz

Apple Mac OS X 10.6.1

• Apple MacOSXUpd10.6.2.dmg
  For Mac OS X v10.6.1
  http://www.apple.com/support/downloads/

MandrakeSoft Corporate Server 3.0

• Mandriva fetchmail-6.2.5-3.8.C30mdk.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva fetchmail-daemon-6.2.5-3.8.C30mdk.i586.rpm
  http://www.mandriva.com/en/download/


• Mandriva fetchmailconf-6.2.5-3.8.C30mdk.i586.rpm
  http://www.mandriva.com/en/download/

Eric Raymond Fetchmail 6.1 .0

• Eric Raymond fetchmail-6.3.11.tar.bz2
  http://prdownload.berlios.de/fetchmail/fetchmail-6.3.11.tar.bz2

Eric Raymond Fetchmail 6.1.3

• Eric Raymond fetchmail-6.3.11.tar.bz2
  http://prdownload.berlios.de/fetchmail/fetchmail-6.3.11.tar.bz2

Eric Raymond Fetchmail 6.2 .0

• Eric Raymond fetchmail-6.3.11.tar.bz2
  http://prdownload.berlios.de/fetchmail/fetchmail-6.3.11.tar.bz2

Eric Raymond Fetchmail 6.2.5 .4

• Eric Raymond fetchmail-6.3.11.tar.bz2
  http://prdownload.berlios.de/fetchmail/fetchmail-6.3.11.tar.bz2

Eric Raymond Fetchmail 6.2.5 .1

• Eric Raymond fetchmail-6.3.11.tar.bz2
  http://prdownload.berlios.de/fetchmail/fetchmail-6.3.11.tar.bz2

Eric Raymond Fetchmail 6.3 .0

• Eric Raymond fetchmail-6.3.11.tar.bz2
  http://prdownload.berlios.de/fetchmail/fetchmail-6.3.11.tar.bz2

Eric Raymond Fetchmail 6.3.2 rc4

• Eric Raymond fetchmail-6.3.11.tar.bz2
  http://prdownload.berlios.de/fetchmail/fetchmail-6.3.11.tar.bz2

Eric Raymond Fetchmail 6.3.2 rc2

• Eric Raymond fetchmail-6.3.11.tar.bz2
  http://prdownload.berlios.de/fetchmail/fetchmail-6.3.11.tar.bz2

Eric Raymond Fetchmail 6.3.2 rc3

• Eric Raymond fetchmail-6.3.11.tar.bz2
  http://prdownload.berlios.de/fetchmail/fetchmail-6.3.11.tar.bz2

Eric Raymond Fetchmail 6.3.5

• Eric Raymond fetchmail-6.3.11.tar.bz2
  http://prdownload.berlios.de/fetchmail/fetchmail-6.3.11.tar.bz2

Slackware Linux 9.1

• Slackware fetchmail-6.3.11-i486-1_slack9.1.tgz
  ftp://ftp.slackware.com/pub/slackware/slackware-9.1/patches/packages/f etchmail-6.3.11-i486-1_slack9.1.tgz

Fetchmail NULL Character CA SSL Certificate Validation Security Bypass Vulnerability

References:

• CVE request: fetchmail <= 6.3.10 SSL certificate NUL prefix verification bypass (Matthias Andree)
  
• Re: CVE request: fetchmail <= 6.3.10 SSL certificate NUL prefix verification byp (Tomas Hoger)
  
• Release Name: fetchmail-6.3.11 (Fetchmail)
  
• fetchmail security announcement fetchmail-SA-2009-01 (CVE-2009-2666) ([email protected])
  
• fetchmail-SA-2009-01: Improper SSL certificate subject verification (Matthias Andree)