CVE-2006-5867

CVE-2006-5867 affects fetchmail prior to 6.3.6-rc4, where TLS enforcement was inadequate and could transmit cleartext passwords over unsecured links, enabling password disclosure via MITM. Connected advisories confirm updated fetchmail packages with TLS enforcement (e.g., enabling TLS1) to fix th...

CVE-2006-5867: Improper Input Validation

fetchmail before 6.3.6-rc4 does not properly enforce TLS and may transmit cleartext passwords over unsecured links if certain circumstances occur, which allows remote attackers to obtain sensitive information via man-in-the-middle MITM attacks...

CVE-2006-5867

fetchmail before 6.3.6-rc4 does not properly enforce TLS and may transmit cleartext passwords over unsecured links if certain circumstances occur, which allows remote attackers to obtain sensitive information via man-in-the-middle MITM attacks...

FreeBSD : fetchmail -- TLS enforcement problem/MITM attack/password exposure (5238ac45-9d8c-11db-858b-0060084a00e5)

Matthias Andree reports : Fetchmail has had several longstanding password disclosure vulnerabilities. - sslcertck/sslfingerprint options should have implied 'sslproto tls1' in order to enforce TLS negotiation, but did not. - Even with 'sslproto tls1' in the config, fetches would go ahead in plain...

Security fix for the ALT Linux 6 package fetchmail version 6.3.6-alt1

Jan. 8, 2007 Michael Shigorin 6.3.6-alt1 - 6.3.6: minor security update CVE-2006-5867, CVE-2006-5974 - replaced Debian menufile with Freedesktop one - spec macro abuse cleanup - NB: added Packager: but I don't use fetchmail for quite a while...

FreeBSD : fetchmail -- crashes when refusing a message bound for an MDA (37e30313-9d8c-11db-858b-0060084a00e5)

Matthias Andree reports : When delivering messages to a message delivery agent by means of the 'mda' option, fetchmail can crash by passing a NULL pointer to ferror and fflush when refusing a message. SMTP and LMTP delivery modes aren't affected. %NASLMINLEVEL 70300 C Tenable Network Security, In...

Fetchmail multiple security vulnerabilities

Multiple password leak problems on inability to establish secured authentication, DoS...

fetchmail security announcement 2006-02 (CVE-2006-5867)

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 fetchmail-SA-2006-02: TLS enforcement problem/MITM attack/password exposure Topics: fetchmail cannot enforce TLS Author: Matthias Andree Version: 1.0 Announced: 2007-01-04 Type: secret information disclosure Impact: fetchmail can expose cleartext...

fetchmail security announcement 2006-03 (CVE-2006-5974)

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 fetchmail-SA-2006-03: crash when refusing message delivered through MDA Topics: fetchmail crashes when refusing a message bound for an MDA Author: Matthias Andree Version: 1.0 Announced: 2007-01-04 Type: denial of service Impact: fetchmail aborts...

fetchmail -- TLS enforcement problem/MITM attack/password exposure

Matthias Andree reports: Fetchmail has had several longstanding password disclosure vulnerabilities. sslcertck/sslfingerprint options should have implied "sslproto tls1" in order to enforce TLS negotiation, but did not. Even with "sslproto tls1" in the config, fetches would go ahead in plain text...

fetchmail -- crashes when refusing a message bound for an MDA

Matthias Andree reports: When delivering messages to a message delivery agent by means of the "mda" option, fetchmail can crash by passing a NULL pointer to ferror and fflush when refusing a message. SMTP and LMTP delivery modes aren't affected...

CVE-2006-5974

fetchmail 6.3.5 and 6.3.6 before 6.3.6-rc4, when refusing a message delivered via the mda option, allows remote attackers to cause a denial of service crash via unknown vectors that trigger a NULL pointer dereference when calling the 1 ferror or 2 fflush functions...

CVE-2006-5974

fetchmail 6.3.5 and 6.3.6 before 6.3.6-rc4, when refusing a message delivered via the mda option, allows remote attackers to cause a denial of service crash via unknown vectors that trigger a NULL pointer dereference when calling the 1 ferror or 2 fflush functions...

CVE-2006-5867

fetchmail before 6.3.6-rc4 does not properly enforce TLS and may transmit cleartext passwords over unsecured links if certain circumstances occur, which allows remote attackers to obtain sensitive information via man-in-the-middle MITM attacks...

DEBIAN-CVE-2006-5974

fetchmail 6.3.5 and 6.3.6 before 6.3.6-rc4, when refusing a message delivered via the mda option, allows remote attackers to cause a denial of service crash via unknown vectors that trigger a NULL pointer dereference when calling the 1 ferror or 2 fflush functions...

CVE-2006-5867

fetchmail before 6.3.6-rc4 does not properly enforce TLS and may transmit cleartext passwords over unsecured links if certain circumstances occur, which allows remote attackers to obtain sensitive information via man-in-the-middle MITM attacks...

CVE-2006-5974

fetchmail 6.3.5 and 6.3.6 before 6.3.6-rc4, when refusing a message delivered via the mda option, allows remote attackers to cause a denial of service crash via unknown vectors that trigger a NULL pointer dereference when calling the 1 ferror or 2 fflush functions...

CVE-2006-5867

fetchmail before 6.3.6-rc4 does not properly enforce TLS and may transmit cleartext passwords over unsecured links if certain circumstances occur, which allows remote attackers to obtain sensitive information via man-in-the-middle MITM attacks...

DEBIAN-CVE-2006-5867

fetchmail before 6.3.6-rc4 does not properly enforce TLS and may transmit cleartext passwords over unsecured links if certain circumstances occur, which allows remote attackers to obtain sensitive information via man-in-the-middle MITM attacks...

Fetchmail POP3客户端缓冲区溢出漏洞

BUGTRAQ ID: 14349 CVECAN ID: CVE-2005-2335 fetchmail是免费的软件包，可以从远程POP2、POP3、IMAP、ETRN或ODMR服务器检索邮件并将其转发给本地SMTP、LMTP服务器或消息传送代理。 fetchmail的POP3客户端在处理服务器回应时存在缓冲区溢出漏洞，恶意服务器可能利用此漏洞在客户端上执行任意指令。...