fetchmail, fetchmailconf security update

2007-06-0723:22:58

CentOS Project

lists.centos.org

2.6 Low

CVSS2

Access Vector

NETWORK

Access Complexity

HIGH

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:H/Au:N/C:P/I:N/A:N

0.063 Low

EPSS

Percentile

93.5%

JSON

CentOS Errata and Security Advisory CESA-2007:0385-01

Fetchmail is a remote mail retrieval and forwarding utility intended
for use over on-demand TCP/IP links, like SLIP or PPP connections.

A flaw was found in the way fetchmail processed certain APOP authentication
requests. By sending certain responses when fetchmail attempted to
authenticate against an APOP server, a remote attacker could potentially
acquire certain portions of a user’s authentication credentials.
(CVE-2007-1558)

All users of fetchmail should upgrade to this updated package, which
contains a backported patch to correct this issue.

Merged security bulletin from advisories:
https://lists.centos.org/pipermail/centos-announce/2007-June/076044.html

Affected packages:
fetchmail
fetchmailconf

OSVersionArchitecturePackageVersionFilename
CentOS2i386fetchmail< 5.9.0-21.7.3.el2.1.6fetchmail-5.9.0-21.7.3.el2.1.6.i386.rpm
CentOS2i386fetchmailconf< 5.9.0-21.7.3.el2.1.6fetchmailconf-5.9.0-21.7.3.el2.1.6.i386.rpm

OS	Version	Architecture	Package	Version	Filename
CentOS	2	i386	fetchmail	< 5.9.0-21.7.3.el2.1.6	fetchmail-5.9.0-21.7.3.el2.1.6.i386.rpm
CentOS	2	i386	fetchmailconf	< 5.9.0-21.7.3.el2.1.6	fetchmailconf-5.9.0-21.7.3.el2.1.6.i386.rpm