[SECURITY] [DSA 900-1] New fetchmail packages fix potential information leak

-------------------------------------------------------------------------- Debian Security Advisory DSA 900-1 [email protected] http://www.debian.org/security/ Martin Schulze November 18th, 2005 http://www.debian.org/security/faq -...

[SECURITY] [DSA 900-1] New fetchmail packages fix potential information leak

-------------------------------------------------------------------------- Debian Security Advisory DSA 900-1 [email protected] http://www.debian.org/security/ Martin Schulze November 18th, 2005 http://www.debian.org/security/faq -...

GLSA-200511-06 : fetchmail: Password exposure in fetchmailconf

The remote host is affected by the vulnerability described in GLSA-200511-06 fetchmail: Password exposure in fetchmailconf Thomas Wolff discovered that fetchmailconf opens the configuration file with default permissions, writes the configuration to it, and only then restricts read permissions to...

fetchmail: Password exposure in fetchmailconf

Background fetchmail is a utility that retrieves and forwards mail from remote systems using IMAP, POP, and other protocols. It ships with fetchmailconf, a graphical utility used to create configuration files. Description Thomas Wolff discovered that fetchmailconf opens the configuration file wit...

fetchmail, fetchmailconf security update

CentOS Errata and Security Advisory CESA-2005:823-01 Updated fetchmail packages that fix insecure configuration file creation is now available. This update has been rated as having low security impact by the Red Hat Security Response Team. Fetchmail is a remote mail retrieval and forwarding...

fetchmail security announcement 2005-02 (CVE-2005-3088)

fetchmail-SA-2005-02: security announcement Topic: password exposure in fetchmailconf Author: Matthias Andree Version: 1.02 Announced: 2005-10-21 Type: insecure creation of file Impact: passwords are written to a world-readable file Danger: medium Credits: Thomas Wolff, Miloslav Trmac for pointin...

RHEL 2.1 : fetchmail (RHSA-2005:823)

Updated fetchmail packages that fix insecure configuration file creation is now available. This update has been rated as having low security impact by the Red Hat Security Response Team. Fetchmail is a remote mail retrieval and forwarding utility. A bug was found in the way the fetchmailconf...

CVE-2005-3088

fetchmailconf before 1.49 in fetchmail 6.2.0, 6.2.5 and 6.2.5.2 creates configuration files with insecure world-readable permissions, which allows local users to obtain sensitive information such as passwords...

CVE-2005-3088

CVE-2005-3088 affects fetchmail and its fetchmailconf component. The advisory describes that, in versions prior to the fixes noted in references, configuration files are created with insecure world-readable permissions, allowing local users to read sensitive data such as passwords. OpenVAS and di...

Low: Red Hat Security Advisory: fetchmail security update

Updated fetchmail packages that fix insecure configuration file creation is now available. This update has been rated as having low security impact by the Red Hat Security Response Team. Fetchmail is a remote mail retrieval and forwarding utility. A bug was found in the way the fetchmailconf...

[SA17293] Fetchmail "fetchmailconf" Password Disclosure Vulnerability

TITLE: Fetchmail "fetchmailconf" Password Disclosure Vulnerability SECUNIA ADVISORY ID: SA17293 VERIFY ADVISORY: http://secunia.com/advisories/17293/ CRITICAL: Less critical IMPACT: Exposure of sensitive information WHERE: Local system SOFTWARE: Fetchmail 6.x http://secunia.com/product/370/...

Slackware 10.0 / 10.1 / 8.1 / 9.0 / 9.1 / current : fetchmail (SSA:2005-203-05)

New fetchmail packages are available for Slackware 8.1, 9.0, 9.1, 10.0, 10.1, and -current to fix security issues. Connecting to a malicious or compromised POP3 server may overflow fetchmail's stack causing a crash or the execution of arbitrary code. %NASLMINLEVEL 70300 C Tenable Network Security...

Mandrake Linux Security Advisory : fetchmail (MDKSA-2005:126)

A buffer overflow was discovered in fetchmail's POP3 client which could allow a malicious server to send a carefully crafted message UID, causing fetchmail to crash or potentially execute arbitrary code as the user running fetchmail. The updated packages have been patched to address this problem...

Fetchmail 6.2.5 exploit for Bugtraq ID: 14349

The following exploit is brought to you by The Mantis Project which is a project geared towards learning the process of discovering and exploiting bugs in the wild. Exploits are based on published advisories which do not contain proof of concept code or unpublished findings. The project's purpose...

Debian DSA-774-1 : fetchmail - buffer overflow

Edward Shornock discovered a bug in the UIDL handling code of fetchmail, a common POP3, APOP and IMAP mail fetching utility. A malicious POP3 server could exploit this problem and inject arbitrary code that will be executed on the victim host. If fetchmail is running as root, this becomes a root...

[SECURITY] [DSA 774-1] New fetchmail packages fix arbitrary code execution

-------------------------------------------------------------------------- Debian Security Advisory DSA 774-1 [email protected] http://www.debian.org/security/ Martin Schulze August 12th, 2005 http://www.debian.org/security/faq -...

[SECURITY] [DSA 774-1] New fetchmail packages fix arbitrary code execution

-------------------------------------------------------------------------- Debian Security Advisory DSA 774-1 [email protected] http://www.debian.org/security/ Martin Schulze August 12th, 2005 http://www.debian.org/security/faq -...

DSA-774-1 fetchmail - buffer overflow

Bulletin has no description...

FreeBSD : fetchmail -- denial of service/crash from malicious POP3 server (3f4ac724-fa8b-11d9-afcf-0060084a00e5)

In fetchmail 6.2.5.1, the remote code injection via POP3 UIDL was fixed, but a denial of service attack was introduced : Two possible NULL pointer dereferences allow a malicious POP3 server to crash fetchmail by respondig with UID lines containing only the article number but no UID in violation o...

FreeBSD : fetchmail -- remote root/code injection from malicious POP3 server (3497d7be-2fef-45f4-8162-9063751b573a)

fetchmail's POP3/UIDL code does not truncate received UIDs properly. A malicious or compromised POP3 server can thus corrupt fetchmail's stack and inject code when fetchmail is using UIDL, either through configuration, or as a result of certain server capabilities. Note that fetchmail is run as...