Fetchmail调试模式远程拒绝服务漏洞

BUGTRAQ ID: 39556 Fetchmail是免费的软件包，可以从远程POP2、POP3、IMAP、ETRN或ODMR服务器检索邮件并将其转发给本地SMTP、LMTP服务器或消息传送代理。 在调试模式（-v -v）中，fetchmail会打印从上级服务器（POP3 UIDL列表）或服务器中所检索到消息头所获得的信息。如果打印消息失败，例如信息（消息头）中包含有无效的多字节字符序列，fetchmail会错误的解释这种情况，认为缓冲区过小，并重新分配更大的缓冲区（线性增加缓冲区大小）。如此多次反复后就会导致分配失败，fetchmail会终止。 Eric Raymond...

fetchmail -- denial of service vulnerability

Fetchmail developer Matthias Andree reported a vulnerability that allows remote attackers to crash the application when it is runs in verbose mode. Fetchmail before release 6.3.17 did not properly sanitize external input mail headers and UID. When a multi-character locale such as UTF-8 was in use...

Security fix for the ALT Linux 5 package fetchmail version 6.3.14-alt1

March 27, 2010 Andrey Rahmatullin 6.3.14-alt1 - 6.3.14 + CVE-2010-0562: heap overrun in verbose SSL cert' info display - package COPYING - remove Packager: - fix buildreqs - fix configure warnings about GSSAPI headers - fix using optflags...

Security fix for the ALT Linux 6 package fetchmail version 6.3.14-alt1

March 27, 2010 Andrey Rahmatullin 6.3.14-alt1 - 6.3.14 + CVE-2010-0562: heap overrun in verbose SSL cert' info display - package COPYING - remove Packager: - fix buildreqs - fix configure warnings about GSSAPI headers - fix using optflags...

Fedora Update for fetchmail FEDORA-2010-3800

Check for the Version of fetchmail OpenVAS Vulnerability Test Fedora Update for fetchmail FEDORA-2010-3800 Authors: System Generated Check Copyright: Copyright c 2010 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under th...

Fedora Update for fetchmail FEDORA-2010-3800

The remote host is missing an update for the SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription scriptxrefname:"URL",...

[SECURITY] Fedora 12 Update: fetchmail-6.3.11-4.fc12

Fetchmail is a remote mail retrieval and forwarding utility intended for use over on-demand TCP/IP links, like SLIP or PPP connections. Fetchmail supports every remote-mail protocol currently in use on the Internet POP2, POP3, RPOP, APOP, KPOP, all IMAPs, ESMTP ETRN, IPv6, and IPSEC for retrieval...

Debian DSA-1852-1 : fetchmail - insufficient input validation

It was discovered that fetchmail, a full-featured remote mail retrieval and forwarding utility, is vulnerable to the 'Null Prefix Attacks Against SSL/TLS Certificates' recently published at the Blackhat conference. This allows an attacker to perform undetected man-in-the-middle attacks via a...

openSUSE Security Update : fetchmail (fetchmail-1996)

This update fixes a heap-based overflow in fetchmail's sdump function. It can be exploited while displaying detailed X.509 certification information to cause a crash or to probably execute arbitrary code too. CVE-2010-0562: CVSS v2 Base Score: 4.0 low AV:N/AC:H/Au:N/C:N/I:P/A:P: Buffer Errors...

Mandriva Update for fetchmail MDVSA-2010:037 (fetchmail)

Check for the Version of fetchmail OpenVAS Vulnerability Test Mandriva Update for fetchmail MDVSA-2010:037 fetchmail Authors: System Generated Check Copyright: Copyright c 2010 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify i...

Mandriva Update for fetchmail MDVSA-2010:037 (fetchmail)

Check for the Version of fetchmail OpenVAS Vulnerability Test Mandriva Update for fetchmail MDVSA-2010:037 fetchmail Authors: System Generated Check Copyright: Copyright c 2010 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify i...

FreeBSD Ports: fetchmail

The remote host is missing an update to the system as announced in the referenced advisory. SPDX-FileCopyrightText: 2010 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

FreeBSD Ports: fetchmail

The remote host is missing an update to the system as announced in the referenced advisory. VID 2a6a966f-1774-11df-b5c1-0026189baca3 OpenVAS Vulnerability Test $ Description: Auto generated from VID 2a6a966f-1774-11df-b5c1-0026189baca3 Authors: Thomas Reinke Copyright: Copyright c 2010 E-Soft Inc...

[ MDVSA-2010:037 ] fetchmail

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Mandriva Linux Security Advisory MDVSA-2010:037 http://www.mandriva.com/security/ Package : fetchmail Date : February 16, 2010 Affected: 2010.0 Problem Description: A vulnerability have been discovered and corrected in fetchmail: The sdump function in...

fetchmail buffer overflow

Buffer overflow in verbose mode on SSL certificate paramters printing...

FreeBSD : fetchmail -- heap overflow on verbose X.509 display (2a6a966f-1774-11df-b5c1-0026189baca3)

Matthias Andree reports : In verbose mode, fetchmail prints X.509 certificate subject and issuer information to the user, and counts and allocates a malloc buffer for that purpose. If the material to be displayed contains characters with high bit set and the platform treats the 'char' type as...

CVE-2010-0562

The sdump function in sdump.c in fetchmail 6.3.11, 6.3.12, and 6.3.13, when running in verbose mode on platforms for which char is signed, allows remote attackers to cause a denial of service application crash or possibly execute arbitrary code via an SSL X.509 certificate containing non-printabl...

DEBIAN-CVE-2010-0562

The sdump function in sdump.c in fetchmail 6.3.11, 6.3.12, and 6.3.13, when running in verbose mode on platforms for which char is signed, allows remote attackers to cause a denial of service application crash or possibly execute arbitrary code via an SSL X.509 certificate containing non-printabl...

CVE-2010-0562

The sdump function in sdump.c in fetchmail 6.3.11, 6.3.12, and 6.3.13, when running in verbose mode on platforms for which char is signed, allows remote attackers to cause a denial of service application crash or possibly execute arbitrary code via an SSL X.509 certificate containing non-printabl...

CVE-2010-0562

The sdump function in sdump.c in fetchmail 6.3.11, 6.3.12, and 6.3.13, when running in verbose mode on platforms for which char is signed, allows remote attackers to cause a denial of service application crash or possibly execute arbitrary code via an SSL X.509 certificate containing non-printabl...