CVE-2009-2666

socket.c in fetchmail before 6.3.11 does not properly handle a '\0' character in a domain name in the subject's Common Name CN field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification...

CVE-2009-2666

socket.c in fetchmail before 6.3.11 does not properly handle a '\0' character in a domain name in the subject's Common Name CN field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification...

Design/Logic Flaw

socket.c in fetchmail before 6.3.11 does not properly handle a '\0' character in a domain name in the subject's Common Name CN field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification...

CVE-2009-2666

socket.c in fetchmail before 6.3.11 does not properly handle a '\0' character in a domain name in the subject's Common Name CN field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification...

CVE-2009-2666

Technical details for CVE-2009-2666 are not present in the provided connected documents. The description here references a domain-name '\0' handling issue in fetchmail, but no vendor/product/version specifics or mitigations are included in the supplied materials. Monitor for updates.

CVE-2009-2666

socket.c in fetchmail before 6.3.11 does not properly handle a '\0' character in a domain name in the subject's Common Name CN field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification...

[SECURITY] [DSA 1852-1] New fetchmail packages fix SSL certificate verification weakness

-------------------------------------------------------------------------- Debian Security Advisory DSA-1852-1 [email protected] http://www.debian.org/security/ Nico Golde August 7th, 2009 http://www.debian.org/security/faq -...

Slackware 10.0 / 10.1 / 10.2 / 11.0 / 12.0 / 12.1 / 12.2 / 8.1 / 9.0 / 9.1 / current : fetchmail (SSA:2009-218-01)

New fetchmail packages are available for Slackware 8.1, 9.0, 9.1, 10.0, 10.1, 10.2, 11.0, 12.0, 12.1, 12.2, and -current to a fix security issue. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from Slackware Security...

CVE-2009-2666: Undefined Security Weakness

socket.c in fetchmail before 6.3.11 does not properly handle a '\0' character in a domain name in the subject's Common Name CN field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification...

DSA-1852-1 fetchmail - SSL certificate verification weakness

Bulletin has no description...

fetchmail

New fetchmail packages are available for Slackware 8.1, 9.0, 9.1, 10.0, 10.1, 10.2, 11.0, 12.0, 12.1, 12.2, and -current to a fix security issue. More details about this issue may be found in the Common Vulnerabilities and Exposures CVE database: https://vulners.com/cve/CVE-2009-2666 Here are the...

Fetchmail NULL字符CA SSL整数验证安全绕过漏洞

Bugraq ID: 35951 Fetchmail是一款功能强大的IMAP和POP客户程序。 Fetchmail不正确验证签名CA证书中包含NULL字符的域名，允许攻击者使用恶意SSL证书替换可信证书，绕过安全检测进行中间人攻击或伪造可信服务器，获得敏感信息。 Fetchmail Fetchmail 6.3.10 Fetchmail Fetchmail 6.3.9 Fetchmail Fetchmail 6.3.8 Fetchmail Fetchmail 6.3.7 Fetchmail Fetchmail 6.3.6 -rc3 Fetchmail Fetchmail 6.3.6 -rc...

fetchmail -- improper SSL certificate subject verification

Matthias Andree reports: Moxie Marlinspike demonstrated in July 2009 that some CAs would sign certificates that contain embedded NUL characters in the Common Name or subjectAltName fields of ITU-T X.509 certificates. Applications that would treat such X.509 strings as NUL-terminated C strings...

fetchmail/mutt/evolution/...: APOP password disclosure vulnerability

The APOP protocol allows remote attackers to guess the first 3 characters of a password via man-in-the-middle MITM attacks that use crafted message IDs and MD5 collisions. NOTE: this design-level issue potentially affects all products that use APOP, including 1 Thunderbird 1.x before 1.5.0.12 and...

FreeBSD : fetchmail -- address parsing vulnerability (af0296be-2455-11d8-82e5-0020ed76ef5a)

Fetchmail can be crashed by a malicious email message. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the FreeBSD VuXML database : Copyright 2003-2018 Jacques Vidrine and contributors Redistribution and use in source...

Mandriva Linux Security Advisory : fetchmail (MDVSA-2008:117)

A flaw in fetchmail was discovered that allowed remote attackers to cause a denial of service crash and persistent mail failure via a malformed message with long headers. The crash only occured when fetchmail was called in '-v -v' mode CVE-2008-2711. The updated packages have been patched to...

FreeBSD : fetchmail -- denial-of-service vulnerability (ac4b9d18-67a9-11d8-80e3-0020ed76ef5a)

Dave Jones discovered a denial-of-service vulnerability in fetchmail. An email message containing a very long line could cause fetchmail to segfault due to missing NUL termination in transact.c. Eric Raymond decided not to mention this issue in the release notes for fetchmail 6.2.5, but it was...

Mandriva Update for fetchmail MDKSA-2007:016 (fetchmail)

Check for the Version of fetchmail OpenVAS Vulnerability Test Mandriva Update for fetchmail MDKSA-2007:016 fetchmail Authors: System Generated Check Copyright: Copyright c 2009 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify i...

Mandriva Update for fetchmail MDKSA-2007:016 (fetchmail)

Check for the Version of fetchmail OpenVAS Vulnerability Test Mandriva Update for fetchmail MDKSA-2007:016 fetchmail Authors: System Generated Check Copyright: Copyright c 2009 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify i...

Mandriva Update for fetchmail MDKSA-2007:105 (fetchmail)

Check for the Version of fetchmail OpenVAS Vulnerability Test Mandriva Update for fetchmail MDKSA-2007:105 fetchmail Authors: System Generated Check Copyright: Copyright c 2009 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify i...