fetchmail: SSL null terminator bypass

socket.c in fetchmail before 6.3.11 does not properly handle a '\0' character in a domain name in the subject's Common Name CN field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification...

Moderate: Red Hat Security Advisory: fetchmail security update

An updated fetchmail package that fixes multiple security issues is now available for Red Hat Enterprise Linux 3, 4, and 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Fetchmail is a remote mail retrieval and forwarding utility intended for...

fetchmail: Crash in large log messages in verbose mode

fetchmail 6.3.8 and earlier, when running in -v -v aka verbose mode, allows remote attackers to cause a denial of service crash and persistent mail failure via a malformed mail message with long headers, which triggers an erroneous dereference when using vsnprintf to format log messages...

Fetchmail NULL pointer dereference

sink.c in fetchmail before 6.3.9 allows context-dependent attackers to cause a denial of service NULL dereference and application crash by refusing certain warning messages that are sent over SMTP...

[SECURITY] Fedora 10 Update: fetchmail-6.3.8-9.fc10

Fetchmail is a remote mail retrieval and forwarding utility intended for use over on-demand TCP/IP links, like SLIP or PPP connections. Fetchmail supports every remote-mail protocol currently in use on the Internet POP2, POP3, RPOP, APOP, KPOP, all IMAPs, ESMTP ETRN, IPv6, and IPSEC for retrieval...

[SECURITY] Fedora 11 Update: fetchmail-6.3.9-5.fc11

Fetchmail is a remote mail retrieval and forwarding utility intended for use over on-demand TCP/IP links, like SLIP or PPP connections. Fetchmail supports every remote-mail protocol currently in use on the Internet POP2, POP3, RPOP, APOP, KPOP, all IMAPs, ESMTP ETRN, IPv6, and IPSEC for retrieval...

Fedora 11 : fetchmail-6.3.9-5.fc11 (2009-8780)

If fetchmail is running in daemon mode, it must be restarted for this update to take effect use the 'fetchmail --quit' command to stop the fetchmail process. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has...

Fedora 10 : fetchmail-6.3.8-9.fc10 (2009-8770)

If fetchmail is running in daemon mode, it must be restarted for this update to take effect use the 'fetchmail --quit' command to stop the fetchmail process. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has...

Debian: Security Advisory (DSA-1852-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Mandrake Security Advisory MDVSA-2009:201 (fetchmail)

The remote host is missing an update to fetchmail announced via advisory MDVSA-2009:201. OpenVAS Vulnerability Test $Id: mdksa2009201.nasl 6573 2017-07-06 13:10:50Z cfischer $ Description: Auto-generated from advisory MDVSA-2009:201 fetchmail Authors: Thomas Reinke Copyright: Copyright c 2009...

Ubuntu: Security Advisory (USN-816-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Ubuntu USN-816-1 (fetchmail)

The remote host is missing an update to fetchmail announced via advisory USN-816-1. OpenVAS Vulnerability Test $Id: ubuntu8161.nasl 7969 2017-12-01 09:23:16Z santu $ $Id: ubuntu8161.nasl 7969 2017-12-01 09:23:16Z santu $ Description: Auto-generated from advisory USN-816-1 fetchmail Authors: Thoma...

FreeBSD Ports: fetchmail

The remote host is missing an update to the system as announced in the referenced advisory. SPDX-FileCopyrightText: 2009 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

FreeBSD Ports: fetchmail

The remote host is missing an update to the system as announced in the referenced advisory. VID 5179d85c-8683-11de-91b9-0022157515b2 OpenVAS Vulnerability Test $ Description: Auto generated from VID 5179d85c-8683-11de-91b9-0022157515b2 Authors: Thomas Reinke Copyright: Copyright c 2009 E-Soft Inc...

Mandrake Security Advisory MDVSA-2009:201 (fetchmail)

The remote host is missing an update to fetchmail announced via advisory MDVSA-2009:201. SPDX-FileCopyrightText: 2009 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only OR...

Debian Security Advisory DSA 1852-1 (fetchmail)

The remote host is missing an update to fetchmail announced via advisory DSA 1852-1. OpenVAS Vulnerability Test $Id: deb18521.nasl 6615 2017-07-07 12:09:52Z cfischer $ Description: Auto-generated from advisory DSA 1852-1 fetchmail Authors: Thomas Reinke Copyright: Copyright c 2009 E-Soft Inc...

Mandriva Linux Security Advisory : fetchmail (MDVSA-2009:201-1)

A vulnerability has been found and corrected in fetchmail : socket.c in fetchmail before 6.3.11 does not properly handle a '' NUL character in a domain name in the subject's Common Name CN and subjectAlternativeName fields of an X.509 certificate, which allows man-in-the-middle attackers to spoof...

Ubuntu 6.06 LTS / 8.04 LTS / 8.10 / 9.04 : fetchmail vulnerability (USN-816-1)

Matthias Andree discovered that fetchmail did not properly handle certificates with NULL characters in the certificate name. A remote attacker could exploit this to perform a man in the middle attack to view sensitive information or alter encrypted communications. Note that Tenable Network Securi...

USN-816-1: fetchmail vulnerability

Matthias Andree discovered that fetchmail did not properly handle certificates with NULL characters in the certificate name. A remote attacker could exploit this to perform a machine-in-the-middle attack to view sensitive information or alter encrypted communications...

FreeBSD : fetchmail -- improper SSL certificate subject verification (5179d85c-8683-11de-91b9-0022157515b2)

Matthias Andree reports : Moxie Marlinspike demonstrated in July 2009 that some CAs would sign certificates that contain embedded NUL characters in the Common Name or subjectAltName fields of ITU-T X.509 certificates. Applications that would treat such X.509 strings as NUL-terminated C strings...