CVE-2006-5974

fetchmail 6.3.5 and 6.3.6 before 6.3.6-rc4, when refusing a message delivered via the mda option, allows remote attackers to cause a denial of service crash via unknown vectors that trigger a NULL pointer dereference when calling the 1 ferror or 2 fflush functions...

CVE-2006-5974

The CVE-2006-5974 issue affects fetchmail 6.3.5 and 6.3.6 before 6.3.6-rc4, where refusing a message via the mda option can trigger a NULL pointer dereference in ferror or fflush, causing remote denial of service (crash). The root cause is a NULL pointer dereference in the handling path. Affected...

Fetchmail多个密码信息泄露漏洞

Fetchmail是一款多功能的IMAP和POP客户程序。 Fetchmail存在设计问题，远程攻击者可以利用漏洞可能获得用户密码敏感信息。 具体问题如下： -sslcertck/sslfingerprint选项本来必须应用到"sslproto tls1"来迫使使用TLS协商，但程序没有。 -在配置文件中即使使用"sslproto tls1"，但如果STLS/STARTTLS没有使用，获取邮件也是明文过程。 -无论TLS选项是否采用，POP3的抓取完全忽略TLS，因为在检查STLS支持前没有可靠的发送CAPA，而CAPA是STLS所必须的。无论CAPA是否检测到，依靠的是"auth"选项...

CVE-2006-5867

fetchmail before 6.3.6-rc4 does not properly enforce TLS and may transmit cleartext passwords over unsecured links if certain circumstances occur, which allows remote attackers to obtain sensitive information via man-in-the-middle MITM attacks...

CVE-2006-5867

CVE-2006-5867 affects fetchmail prior to 6.3.6-rc4, where TLS enforcement was inadequate and could transmit cleartext passwords over unsecured links, enabling password disclosure via MITM. Connected advisories confirm updated fetchmail packages with TLS enforcement (e.g., enabling TLS1) to fix th...

FreeBSD : fetchmail -- TLS enforcement problem/MITM attack/password exposure (5238ac45-9d8c-11db-858b-0060084a00e5)

Matthias Andree reports : Fetchmail has had several longstanding password disclosure vulnerabilities. - sslcertck/sslfingerprint options should have implied 'sslproto tls1' in order to enforce TLS negotiation, but did not. - Even with 'sslproto tls1' in the config, fetches would go ahead in plain...

FreeBSD : fetchmail -- crashes when refusing a message bound for an MDA (37e30313-9d8c-11db-858b-0060084a00e5)

Matthias Andree reports : When delivering messages to a message delivery agent by means of the 'mda' option, fetchmail can crash by passing a NULL pointer to ferror and fflush when refusing a message. SMTP and LMTP delivery modes aren't affected. %NASLMINLEVEL 70300 C Tenable Network Security, In...

Security fix for the ALT Linux 6 package fetchmail version 6.3.6-alt1

Jan. 8, 2007 Michael Shigorin 6.3.6-alt1 - 6.3.6: minor security update CVE-2006-5867, CVE-2006-5974 - replaced Debian menufile with Freedesktop one - spec macro abuse cleanup - NB: added Packager: but I don't use fetchmail for quite a while...

Fetchmail multiple security vulnerabilities

Multiple password leak problems on inability to establish secured authentication, DoS...

fetchmail security announcement 2006-02 (CVE-2006-5867)

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 fetchmail-SA-2006-02: TLS enforcement problem/MITM attack/password exposure Topics: fetchmail cannot enforce TLS Author: Matthias Andree Version: 1.0 Announced: 2007-01-04 Type: secret information disclosure Impact: fetchmail can expose cleartext...

fetchmail security announcement 2006-03 (CVE-2006-5974)

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 fetchmail-SA-2006-03: crash when refusing message delivered through MDA Topics: fetchmail crashes when refusing a message bound for an MDA Author: Matthias Andree Version: 1.0 Announced: 2007-01-04 Type: denial of service Impact: fetchmail aborts...

fetchmail -- TLS enforcement problem/MITM attack/password exposure

Matthias Andree reports: Fetchmail has had several longstanding password disclosure vulnerabilities. sslcertck/sslfingerprint options should have implied "sslproto tls1" in order to enforce TLS negotiation, but did not. Even with "sslproto tls1" in the config, fetches would go ahead in plain text...

fetchmail -- crashes when refusing a message bound for an MDA

Matthias Andree reports: When delivering messages to a message delivery agent by means of the "mda" option, fetchmail can crash by passing a NULL pointer to ferror and fflush when refusing a message. SMTP and LMTP delivery modes aren't affected...

CVE-2006-5974

fetchmail 6.3.5 and 6.3.6 before 6.3.6-rc4, when refusing a message delivered via the mda option, allows remote attackers to cause a denial of service crash via unknown vectors that trigger a NULL pointer dereference when calling the 1 ferror or 2 fflush functions...

CVE-2006-5974

fetchmail 6.3.5 and 6.3.6 before 6.3.6-rc4, when refusing a message delivered via the mda option, allows remote attackers to cause a denial of service crash via unknown vectors that trigger a NULL pointer dereference when calling the 1 ferror or 2 fflush functions...

CVE-2006-5867

fetchmail before 6.3.6-rc4 does not properly enforce TLS and may transmit cleartext passwords over unsecured links if certain circumstances occur, which allows remote attackers to obtain sensitive information via man-in-the-middle MITM attacks...

DEBIAN-CVE-2006-5974

fetchmail 6.3.5 and 6.3.6 before 6.3.6-rc4, when refusing a message delivered via the mda option, allows remote attackers to cause a denial of service crash via unknown vectors that trigger a NULL pointer dereference when calling the 1 ferror or 2 fflush functions...

CVE-2006-5867

fetchmail before 6.3.6-rc4 does not properly enforce TLS and may transmit cleartext passwords over unsecured links if certain circumstances occur, which allows remote attackers to obtain sensitive information via man-in-the-middle MITM attacks...

CVE-2006-5974

fetchmail 6.3.5 and 6.3.6 before 6.3.6-rc4, when refusing a message delivered via the mda option, allows remote attackers to cause a denial of service crash via unknown vectors that trigger a NULL pointer dereference when calling the 1 ferror or 2 fflush functions...

CVE-2006-5867

fetchmail before 6.3.6-rc4 does not properly enforce TLS and may transmit cleartext passwords over unsecured links if certain circumstances occur, which allows remote attackers to obtain sensitive information via man-in-the-middle MITM attacks...