Eric S. Raymond Fetchmail Unspecified Denial of Service Vulnerability

Bugtraq ID:	8843
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2003-0792
Remote:	Yes
Local:	No
Published:	Oct 16 2003 12:00AM
Updated:	Nov 30 2006 08:25PM
Credit:	This issue was disclosed by Mandrake Linux.
Vulnerable:	Turbolinux Turbolinux Workstation 8.0 Turbolinux Turbolinux Workstation 7.0 Turbolinux Turbolinux Workstation 6.0 Turbolinux Turbolinux Server 8.0 Turbolinux Turbolinux Server 7.0 Turbolinux Turbolinux Server 6.1 Turbolinux Turbolinux Desktop 10.0 Turbolinux Turbolinux Advanced Server 6.0 Turbolinux Turbolinux 6.0.5 Trend Micro InterScan VirusWall for Unix 6.0.5 SCO OpenLinux Workstation 3.1.1 SCO OpenLinux Server 3.1.1 Redhat Linux 9.0 i386 Redhat Linux 7.3 i386 Redhat Fedora Core2 Redhat Fedora Core1 OpenPKG OpenPKG 1.3 Netwosix Netwosix Linux 1.0 Gentoo Linux 1.4 _rc3 Gentoo Linux 1.4 _rc2 Gentoo Linux 1.4 _rc1 Gentoo Linux 1.4 Gentoo Linux 1.2 Gentoo Linux 1.1 a Gentoo Linux 0.7 Gentoo Linux 0.5 Eric Raymond Fetchmail 6.2.4 Eric Raymond Fetchmail 6.2.2 Eric Raymond Fetchmail 5.9 .0 + Immunix Immunix OS 7+ + Redhat Linux 8.0 i386 + Redhat Linux 8.0 + Redhat Linux 7.3 i386 + Redhat Linux 7.3 + Redhat Linux 7.2 ia64 + Redhat Linux 7.2 i386 + Redhat Linux 7.2 alpha + Redhat Linux 7.2 + Redhat Linux 7.1 ia64 + Redhat Linux 7.1 i386 + Redhat Linux 7.1 alpha + Redhat Linux 7.1 + Redhat Linux 7.0 sparc + Redhat Linux 7.0 i386 + Redhat Linux 7.0 alpha + Redhat Linux 7.0 + Redhat Linux 6.2 sparc + Redhat Linux 6.2 i386 + Redhat Linux 6.2 alpha + Redhat Linux 6.2 + Sun Linux 5.0 + SuSE Linux 7.3 sparc + SuSE Linux 7.3 ppc + SuSE Linux 7.3 i386 + SuSE Linux 7.3 Apple Mac OS X Server 10.3.2 Apple Mac OS X Server 10.2.8 Apple Mac OS X 10.3.2 Apple Mac OS X 10.2.8
Not Vulnerable:

Eric S. Raymond Fetchmail Unspecified Denial of Service Vulnerability

Fetchmail 6.2.4 is reported prone to a denial-of-service issue that may allow an attacker to crash the software by sending a specially crafted email message. Exact details of this issue are not currently known, but attackers may be able to cause a denial-of-service condition or execute arbitrary code in the vulnerable software.

This vulnerability may be related to known issues, but Symantec has not confirmed this. This BID and any other applicable BIDs will be updated as further information is available.

Fetchmail version 6.2.4 has been reported prone to this issue, but other versions may be vulnerable as well.

Eric S. Raymond Fetchmail Unspecified Denial of Service Vulnerability


Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected]

Eric S. Raymond Fetchmail Unspecified Denial of Service Vulnerability

Solution:
Fixes are available. Please see the referenced advisories for more information.


Netwosix Netwosix Linux 1.0

• Netwosix fetchmail-6.2.5.tar.gz
  http://download.netwosix.org/0002/fetchmail-6.2.5.tar.gz

OpenPKG OpenPKG 1.3

• OpenPKG fetchmail-6.2.3-1.3.1.src.rpm
  ftp://ftp.openpkg.org/release/1.3/UPD/fetchmail-6.2.3-1.3.1.src.rpm

Turbolinux Turbolinux Desktop 10.0

• TurboLinux fetchmail-6.2.5-1.i586.rpm
  ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Desktop/10/u pdates/RPMS/fetchmail-6.2.5-1.i586.rpm


• TurboLinux fetchmailconf-6.2.5-1.i586.rpm
  ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Desktop/10/u pdates/RPMS/fetchmailconf-6.2.5-1.i586.rpm

SCO OpenLinux Workstation 3.1.1

• SCO fetchmail-6.2.5-1.i386.rpm
  ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Workstation/CSSA-2004-00 4.0/RPMS/fetchmail-6.2.5-1.i386.rpm


• SCO fetchmailconf-6.2.5-1.i386.rpm
  ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Workstation/CSSA-2004-00 4.0/RPMS/fetchmailconf-6.2.5-1.i386.rpm

SCO OpenLinux Server 3.1.1

• SCO fetchmail-6.2.5-1.i386.rpm
  OpenLinux 3.1.1 Server:
  ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Server/CSSA-2004-004.0/R PMS/fetchmail-6.2.5-1.i386.rpm


• SCO fetchmailconf-6.2.5-1.i386.rpm
  OpenLinux 3.1.1 Server:
  ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Server/CSSA-2004-004.0/R PMS/fetchmailconf-6.2.5-1.i386.rpm

Eric Raymond Fetchmail 5.9 .0

• Immunix fetchmail-5.9.0-10_imnx_1.i386.rpm
  http://download.immunix.org/ImmunixOS/7+/Updates/RPMS/fetchmail-5.9.0- 10_imnx_1.i386.rpm


• Immunix fetchmailconf-5.9.0-10_imnx_1.i386.rpm
  http://download.immunix.org/ImmunixOS/7+/Updates/RPMS/fetchmailconf-5. 9.0-10_imnx_1.i386.rpm


• RedHat fetchmail-5.9.0-21.7.3.2.legacy.i386.rpm
  Red Hat Linux 7.3:
  http://download.fedoralegacy.org/redhat/7.3/updates/i386/fetchmail-5.9 .0-21.7.3.2.legacy.i386.rpm


• RedHat fetchmailconf-5.9.0-21.7.3.2.legacy.i386.rpm
  Red Hat Linux 7.3:
  http://download.fedoralegacy.org/redhat/7.3/updates/i386/fetchmailconf -5.9.0-21.7.3.2.legacy.i386.rpm

Turbolinux Turbolinux Advanced Server 6.0

• TurboLinux fetchmail-6.2.5-1.i386.rpm
  ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/AdvancedServ er/6/ja/updates/RPMS/fetchmail-6.2.5-1.i386.rpm


• TurboLinux fetchmailconf-6.2.5-1.i386.rpm
  ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/AdvancedServ er/6/ja/updates/RPMS/fetchmailconf-6.2.5-1.i386.rpm

Turbolinux Turbolinux Workstation 6.0

• TurboLinux fetchmail-6.2.5-1.i386.rpm
  ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Workstation/ 6.0/ja/updates/RPMS/fetchmail-6.2.5-1.i386.rpm


• TurboLinux fetchmailconf-6.2.5-1.i386.rpm
  ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Workstation/ 6.0/ja/updates/RPMS/fetchmailconf-6.2.5-1.i386.rpm

Turbolinux Turbolinux Server 6.1

• TurboLinux fetchmail-6.2.5-1.i386.rpm
  ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/6.1/j a/updates/RPMS/fetchmail-6.2.5-1.i386.rpm


• TurboLinux fetchmailconf-6.2.5-1.i386.rpm
  ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/6.1/j a/updates/RPMS/fetchmailconf-6.2.5-1.i386.rpm

Eric Raymond Fetchmail 6.2.2

• Slackware fetchmail-6.2.5-i386-1.tgz
  ftp://ftp.slackware.com/pub/slackware/slackware-9.0/patches/packages/f etchmail-6.2.5-i386-1.tgz

Eric Raymond Fetchmail 6.2.4

• Mandrake fetchmail-6.2.4-1.1.92mdk.i586.rpm
  http://www.mandrakesecure.net/en/ftp.php


• Mandrake fetchmail-daemon-6.2.4-1.1.92mdk.i586.rpm
  http://www.mandrakesecure.net/en/ftp.php


• Mandrake fetchmailconf-6.2.4-1.1.92mdk.i586.rpm
  http://www.mandrakesecure.net/en/ftp.php


• Slackware fetchmail-6.2.5-i486-1.tgz
  ftp://ftp.slackware.com/pub/slackware/slackware-9.1/patches/packages/f etchmail-6.2.5-i486-1.tgz

Turbolinux Turbolinux Server 7.0

• TurboLinux fetchmail-6.2.5-1.i586.rpm
  ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/7/upd ates/RPMS/fetchmail-6.2.5-1.i586.rpm


• TurboLinux fetchmailconf-6.2.5-1.i586.rpm
  ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/7/upd ates/RPMS/fetchmailconf-6.2.5-1.i586.rpm

Turbolinux Turbolinux Workstation 7.0

• TurboLinux fetchmail-6.2.5-1.i586.rpm
  ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Workstation/ 7/updates/RPMS/fetchmail-6.2.5-1.i586.rpm


• TurboLinux fetchmailconf-6.2.5-1.i586.rpm
  ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Workstation/ 7/updates/RPMS/fetchmailconf-6.2.5-1.i586.rpm

Turbolinux Turbolinux Workstation 8.0

• TurboLinux fetchmail-6.2.5-1.i586.rpm
  ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Workstation/ 8/updates/RPMS/fetchmail-6.2.5-1.i586.rpm


• TurboLinux fetchmailconf-6.2.5-1.i586.rpm
  ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Workstation/ 8/updates/RPMS/fetchmailconf-6.2.5-1.i586.rpm

Turbolinux Turbolinux Server 8.0

• TurboLinux fetchmail-6.2.5-1.i586.rpm
  ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/8/upd ates/RPMS/fetchmail-6.2.5-1.i586.rpm


• TurboLinux fetchmailconf-6.2.5-1.i586.rpm
  ftp://ftp.turbolinux.co.jp/pub/TurboLinux/TurboLinux/ia32/Server/8/upd ates/RPMS/fetchmailconf-6.2.5-1.i586.rpm

Eric S. Raymond Fetchmail Unspecified Denial of Service Vulnerability

References:

• Fetchmail Homepage (Eric Raymond)