Code injection

The APOP protocol allows remote attackers to guess the first 3 characters of a password via man-in-the-middle MITM attacks that use crafted message IDs and MD5 collisions. NOTE: this design-level issue potentially affects all products that use APOP, including 1 Thunderbird 1.x before 1.5.0.12 and...

CVE-2007-1558

CVE-2007-1558 describes a cryptographic weakness in APOP authentication that lowers MITM attack cost to recover passwords. Connected advisories show this affects multiple mail clients (e.g., Thunderbird/Icedove, Iceape, fetchmail) and related POP/ALOP implementations. Debian DSA-1305-1 and CentOS...

CVE-2007-1558: Undefined Security Weakness

The APOP protocol allows remote attackers to guess the first 3 characters of a password via man-in-the-middle MITM attacks that use crafted message IDs and MD5 collisions. NOTE: this design-level issue potentially affects all products that use APOP, including 1 Thunderbird 1.x before 1.5.0.12 and...

FreeBSD : fetchmail -- insecure APOP authentication (f1c4d133-e6d3-11db-99ea-0060084a00e5)

Matthias Andree reports : The POP3 standard, currently RFC-1939, has specified an optional, MD5-based authentication scheme called 'APOP' which no longer should be considered secure. Additionally, fetchmail's POP3 client implementation has been validating the APOP challenge too lightly and accept...

Security fix for the ALT Linux 6 package fetchmail version 6.3.8-alt1

April 7, 2007 Michael Shigorin 6.3.8-alt1 - 6.3.8 + APOP was strengthened to make the CVE-2007-1558 attack harder + crash when opening the BSMTP output file failed was fixed + other fixes and improvements...

fetchmail -- insecure APOP authentication

Matthias Andree reports: The POP3 standard, currently RFC-1939, has specified an optional, MD5-based authentication scheme called "APOP" which no longer should be considered secure. Additionally, fetchmail's POP3 client implementation has been validating the APOP challenge too lightly and accepte...

Mandrake Linux Security Advisory : fetchmail (MDKSA-2007:016)

Fetchmail before 6.3.6-rc4 does not properly enforce TLS and may transmit cleartext passwords over unsecured links if certain circumstances occur, which allows remote attackers to obtain sensitive information via man-in-the-middle MITM attacks. The updated packages have been patched to correct th...

Slackware 10.0 / 10.1 / 10.2 / 11.0 / 8.1 / 9.0 / 9.1 : fetchmail (SSA:2007-024-01)

New fetchmail packages are available for Slackware 8.1, 9.0, 9.1, 10.0, 10.1, 10.2, and 11.0 to fix a security issue. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Slackware Security Advisory 2007-024-01. The text...

Debian DSA-1259-1 : fetchmail - programming error

Isaac Wilcox discovered that fetchmail, a popular mail retrieval and forwarding utility, insufficiently enforces encryption of connections, which might lead to information disclosure. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were...

[SECURITY] [DSA 1259-1] New fetchmail packages fix information disclosure

-------------------------------------------------------------------------- Debian Security Advisory DSA 1259-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff February 14th, 2007 http://www.debian.org/security/faq -...

DSA-1259-1 fetchmail

Bulletin has no description...

RHEL 2.1 / 3 / 4 : fetchmail (RHSA-2007:0018)

Updated fetchmail packages that fix two security issues are now available. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Fetchmail is a remote mail retrieval and forwarding utility. A denial of service flaw was found when Fetchmail was run in...

CentOS 3 / 4 : fetchmail (CESA-2007:0018)

Updated fetchmail packages that fix two security issues are now available. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Fetchmail is a remote mail retrieval and forwarding utility. A denial of service flaw was found when Fetchmail was run in...

Moderate: fetchmail security update

6.2.5-6.el4.5 - Fix a KPOP support regression Related: 221985 223661 6.2.5-6.el4.4 - Fix V2,V3,V4 of CAN-2006-5867 Resolves: 221985 6.2.5-6.el4.3 - Fix CAN-2005-4348 176266 - Add BuildRequires: gettext-devel 164351 6.2.5-6.el4.1 - Fix CAN-2005-2335 163816, patch by Ludwig Nussel...

fetchmail, fetchmailconf security update

CentOS Errata and Security Advisory CESA-2007:0018-01 Updated fetchmail packages that fix two security issues are now available. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Fetchmail is a remote mail retrieval and forwarding utility. A deni...

fetchmail security update

CentOS Errata and Security Advisory CESA-2007:0018 Updated fetchmail packages that fix two security issues are now available. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Fetchmail is a remote mail retrieval and forwarding utility. A denial ...

Moderate: Red Hat Security Advisory: fetchmail security update

Updated fetchmail packages that fix two security issues are now available. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Fetchmail is a remote mail retrieval and forwarding utility. A denial of service flaw was found when Fetchmail was run in...

fetchmail not enforcing TLS for POP3 properly

fetchmail before 6.3.6-rc4 does not properly enforce TLS and may transmit cleartext passwords over unsecured links if certain circumstances occur, which allows remote attackers to obtain sensitive information via man-in-the-middle MITM attacks...

security flaw

fetchmail before 6.3.1 and before 6.2.5.5, when configured for multidrop mode, allows remote attackers to cause a denial of service application crash by sending messages without headers from upstream mail servers...

GLSA-200701-13 : Fetchmail: Denial of Service and password disclosure

The remote host is affected by the vulnerability described in GLSA-200701-13 Fetchmail: Denial of Service and password disclosure Neil Hoggarth has discovered that when delivering messages to a message delivery agent by means of the 'mda' option, Fetchmail passes a NULL pointer to the ferror and...