35 matches found
[SECURITY] [DSA 900-3] New fetchmail-ssl packages fix potential information leak
-------------------------------------------------------------------------- Debian Security Advisory DSA 900-3 [email protected] http://www.debian.org/security/ Martin Schulze November 22nd, 2005 http://www.debian.org/security/faq -...
[SECURITY] [DSA 900-2] New fetchmail packages fix potential information leak
-------------------------------------------------------------------------- Debian Security Advisory DSA 900-2 [email protected] http://www.debian.org/security/ Martin Schulze November 21st, 2005 http://www.debian.org/security/faq -...
USN-215-1: fetchmailconf vulnerability
Thomas Wolff and Miloslav Trmac discovered a race condition in the fetchmailconf program. The output configuration file was initially created with insecure permissions, and secure permissions were applied after writing the configuration into the file. During this time, the file was world readable...
GLSA-200511-06 : fetchmail: Password exposure in fetchmailconf
The remote host is affected by the vulnerability described in GLSA-200511-06 fetchmail: Password exposure in fetchmailconf Thomas Wolff discovered that fetchmailconf opens the configuration file with default permissions, writes the configuration to it, and only then restricts read permissions to...
fetchmail: Password exposure in fetchmailconf
Background fetchmail is a utility that retrieves and forwards mail from remote systems using IMAP, POP, and other protocols. It ships with fetchmailconf, a graphical utility used to create configuration files. Description Thomas Wolff discovered that fetchmailconf opens the configuration file wit...
fetchmail, fetchmailconf security update
CentOS Errata and Security Advisory CESA-2005:823-01 Updated fetchmail packages that fix insecure configuration file creation is now available. This update has been rated as having low security impact by the Red Hat Security Response Team. Fetchmail is a remote mail retrieval and forwarding...
fetchmail security announcement 2005-02 (CVE-2005-3088)
fetchmail-SA-2005-02: security announcement Topic: password exposure in fetchmailconf Author: Matthias Andree Version: 1.02 Announced: 2005-10-21 Type: insecure creation of file Impact: passwords are written to a world-readable file Danger: medium Credits: Thomas Wolff, Miloslav Trmac for pointin...
CVE-2005-3088
fetchmailconf before 1.49 in fetchmail 6.2.0, 6.2.5 and 6.2.5.2 creates configuration files with insecure world-readable permissions, which allows local users to obtain sensitive information such as passwords...
CVE-2005-3088
fetchmailconf before 1.49 in fetchmail 6.2.0, 6.2.5 and 6.2.5.2 creates configuration files with insecure world-readable permissions, which allows local users to obtain sensitive information such as passwords...
DEBIAN-CVE-2005-3088
fetchmailconf before 1.49 in fetchmail 6.2.0, 6.2.5 and 6.2.5.2 creates configuration files with insecure world-readable permissions, which allows local users to obtain sensitive information such as passwords...
CVE-2005-3088
CVE-2005-3088 affects fetchmail and its fetchmailconf component. The advisory describes that, in versions prior to the fixes noted in references, configuration files are created with insecure world-readable permissions, allowing local users to read sensitive data such as passwords. OpenVAS and di...
CVE-2005-3088
fetchmailconf before 1.49 in fetchmail 6.2.0, 6.2.5 and 6.2.5.2 creates configuration files with insecure world-readable permissions, which allows local users to obtain sensitive information such as passwords...
CVE-2005-3088
fetchmailconf before 1.49 in fetchmail 6.2.0, 6.2.5 and 6.2.5.2 creates configuration files with insecure world-readable permissions, which allows local users to obtain sensitive information such as passwords...
fetchmail -- fetchmailconf local password exposure
The fetchmail team reports: The fetchmailconf program before and excluding version 1.49 opened the run control file, wrote the configuration to it, and only then changed the mode to 0600 rw-------. Writing the file, which usually contains passwords, before making it unreadable to other users, can...