{"altlinux": [{"lastseen": "2023-03-31T19:18:53", "description": "Dec. 1, 2008 Afanasov Dmitry 6.3.9-alt1\n \n \n - 6.3.9\n + CVE-2007-4565: Denial of service\n + CVE-2008-2711: Denial of service\n + close memory leak when SSL connection fails\n and other\n - remove obsolete update_menus/clean_menus macroses\n", "cvss3": {}, "published": "2008-12-01T00:00:00", "type": "altlinux", "title": "Security fix for the ALT Linux 5 package fetchmail version 6.3.9-alt1", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "PARTIAL", "integrityImpact": "NONE", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2007-4565", "CVE-2008-2711"], "modified": "2008-12-01T00:00:00", "id": "A19360BE5805149A573145A2DF7B635A", "href": "https://packages.altlinux.org/en/p5/srpms/fetchmail/", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2023-03-31T19:19:53", "description": "Dec. 1, 2008 Afanasov Dmitry 6.3.9-alt1\n \n \n - 6.3.9\n + CVE-2007-4565: Denial of service\n + CVE-2008-2711: Denial of service\n + close memory leak when SSL connection fails\n and other\n - remove obsolete update_menus/clean_menus macroses\n", "cvss3": {}, "published": "2008-12-01T00:00:00", "type": "altlinux", "title": "Security fix for the ALT Linux 6 package fetchmail version 6.3.9-alt1", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "PARTIAL", "integrityImpact": "NONE", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2007-4565", "CVE-2008-2711"], "modified": "2008-12-01T00:00:00", "id": "EA3CF5A171C000543432997BE8A06462", "href": "https://packages.altlinux.org/en/p6/srpms/fetchmail/", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2023-03-31T19:18:53", "description": "Sept. 5, 2007 Michael Shigorin 6.3.8-alt4\n \n \n - added patch from fetchmail-SA-2007-02 fixing CVE-2007-4565:\n NULL pointer dereference trigged by outside circumstances\n", "cvss3": {}, "published": "2007-09-05T00:00:00", "type": "altlinux", "title": "Security fix for the ALT Linux 5 package fetchmail version 6.3.8-alt4", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "PARTIAL", "integrityImpact": "NONE", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2007-4565"], "modified": "2007-09-05T00:00:00", "id": "16B72590C134C7EA6CB868CB2D619469", "href": "https://packages.altlinux.org/en/p5/srpms/fetchmail/", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2023-03-31T19:19:53", "description": "Sept. 5, 2007 Michael Shigorin 6.3.8-alt4\n \n \n - added patch from fetchmail-SA-2007-02 fixing CVE-2007-4565:\n NULL pointer dereference trigged by outside circumstances\n", "cvss3": {}, "published": "2007-09-05T00:00:00", "type": "altlinux", "title": "Security fix for the ALT Linux 6 package fetchmail version 6.3.8-alt4", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "PARTIAL", "integrityImpact": "NONE", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2007-4565"], "modified": "2007-09-05T00:00:00", "id": "406DCD60A0E94A77AF44200ABD7B468F", "href": "https://packages.altlinux.org/en/p6/srpms/fetchmail/", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}], "openvas": [{"lastseen": "2019-05-29T18:39:33", "description": "The remote host is missing an update for the ", "cvss3": {}, "published": "2011-08-09T00:00:00", "type": "openvas", "title": "CentOS Update for fetchmail CESA-2009:1427 centos3 i386", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2009-2666", "CVE-2007-4565", "CVE-2008-2711"], "modified": "2019-03-15T00:00:00", "id": "OPENVAS:1361412562310880879", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310880879", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# CentOS Update for fetchmail CESA-2009:1427 centos3 i386\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (c) 2011 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_xref(name:\"URL\", value:\"http://lists.centos.org/pipermail/centos-announce/2009-September/016125.html\");\n script_oid(\"1.3.6.1.4.1.25623.1.0.880879\");\n script_version(\"$Revision: 14222 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-15 13:50:48 +0100 (Fri, 15 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2011-08-09 08:20:34 +0200 (Tue, 09 Aug 2011)\");\n script_tag(name:\"cvss_base\", value:\"6.4\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:P/I:P/A:N\");\n script_xref(name:\"CESA\", value:\"2009:1427\");\n script_cve_id(\"CVE-2007-4565\", \"CVE-2008-2711\", \"CVE-2009-2666\");\n script_name(\"CentOS Update for fetchmail CESA-2009:1427 centos3 i386\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'fetchmail'\n package(s) announced via the referenced advisory.\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2011 Greenbone Networks GmbH\");\n script_family(\"CentOS Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/centos\", \"ssh/login/rpms\", re:\"ssh/login/release=CentOS3\");\n script_tag(name:\"affected\", value:\"fetchmail on CentOS 3\");\n script_tag(name:\"insight\", value:\"Fetchmail is a remote mail retrieval and forwarding utility intended for\n use over on-demand TCP/IP links, such as SLIP and PPP connections.\n\n It was discovered that fetchmail is affected by the previously published\n 'null prefix attack', caused by incorrect handling of NULL characters in\n X.509 certificates. If an attacker is able to get a carefully-crafted\n certificate signed by a trusted Certificate Authority, the attacker could\n use the certificate during a man-in-the-middle attack and potentially\n confuse fetchmail into accepting it by mistake. (CVE-2009-2666)\n\n A flaw was found in the way fetchmail handles rejections from a remote SMTP\n server when sending warning mail to the postmaster. If fetchmail sent a\n warning mail to the postmaster of an SMTP server and that SMTP server\n rejected it, fetchmail could crash. (CVE-2007-4565)\n\n A flaw was found in fetchmail. When fetchmail is run in double verbose\n mode ('-v -v'), it could crash upon receiving certain, malformed mail\n messages with long headers. A remote attacker could use this flaw to cause\n a denial of service if fetchmail was also running in daemon mode ('-d').\n (CVE-2008-2711)\n\n Note: when using SSL-enabled services, it is recommended that the fetchmail\n '--sslcertck' option be used to enforce strict SSL certificate checking.\n\n All fetchmail users should upgrade to this updated package, which contains\n backported patches to correct these issues. If fetchmail is running in\n daemon mode, it must be restarted for this update to take effect (use the\n 'fetchmail --quit' command to stop the fetchmail process).\");\n script_tag(name:\"solution\", value:\"Please install the updated packages.\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\n\nif(release == \"CentOS3\")\n{\n\n if ((res = isrpmvuln(pkg:\"fetchmail\", rpm:\"fetchmail~6.2.0~3.el3.5\", rls:\"CentOS3\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 6.4, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:N"}}, {"lastseen": "2018-04-06T11:37:23", "description": "The remote host is missing updates announced in\nadvisory RHSA-2009:1427.\n\nFetchmail is a remote mail retrieval and forwarding utility intended for\nuse over on-demand TCP/IP links, such as SLIP and PPP connections.\n\nIt was discovered that fetchmail is affected by the previously published\nnull prefix attack, caused by incorrect handling of NULL characters in\nX.509 certificates. If an attacker is able to get a carefully-crafted\ncertificate signed by a trusted Certificate Authority, the attacker could\nuse the certificate during a man-in-the-middle attack and potentially\nconfuse fetchmail into accepting it by mistake. (CVE-2009-2666)\n\nA flaw was found in the way fetchmail handles rejections from a remote SMTP\nserver when sending warning mail to the postmaster. If fetchmail sent a\nwarning mail to the postmaster of an SMTP server and that SMTP server\nrejected it, fetchmail could crash. (CVE-2007-4565)\n\nA flaw was found in fetchmail. When fetchmail is run in double verbose\nmode (-v -v), it could crash upon receiving certain, malformed mail\nmessages with long headers. A remote attacker could use this flaw to cause\na denial of service if fetchmail was also running in daemon mode (-d).\n(CVE-2008-2711)\n\nNote: when using SSL-enabled services, it is recommended that the fetchmail\n--sslcertck option be used to enforce strict SSL certificate checking.\n\nAll fetchmail users should upgrade to this updated package, which contains\nbackported patches to correct these issues. If fetchmail is running in\ndaemon mode, it must be restarted for this update to take effect (use the\nfetchmail --quit command to stop the fetchmail process).", "cvss3": {}, "published": "2009-09-09T00:00:00", "type": "openvas", "title": "RedHat Security Advisory RHSA-2009:1427", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2009-2666", "CVE-2007-4565", "CVE-2008-2711"], "modified": "2018-04-06T00:00:00", "id": "OPENVAS:136141256231064808", "href": "http://plugins.openvas.org/nasl.php?oid=136141256231064808", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: RHSA_2009_1427.nasl 9350 2018-04-06 07:03:33Z cfischer $\n# Description: Auto-generated from advisory RHSA-2009:1427 ()\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# or at your option, GNU General Public License version 3,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ninclude(\"revisions-lib.inc\");\ntag_summary = \"The remote host is missing updates announced in\nadvisory RHSA-2009:1427.\n\nFetchmail is a remote mail retrieval and forwarding utility intended for\nuse over on-demand TCP/IP links, such as SLIP and PPP connections.\n\nIt was discovered that fetchmail is affected by the previously published\nnull prefix attack, caused by incorrect handling of NULL characters in\nX.509 certificates. If an attacker is able to get a carefully-crafted\ncertificate signed by a trusted Certificate Authority, the attacker could\nuse the certificate during a man-in-the-middle attack and potentially\nconfuse fetchmail into accepting it by mistake. (CVE-2009-2666)\n\nA flaw was found in the way fetchmail handles rejections from a remote SMTP\nserver when sending warning mail to the postmaster. If fetchmail sent a\nwarning mail to the postmaster of an SMTP server and that SMTP server\nrejected it, fetchmail could crash. (CVE-2007-4565)\n\nA flaw was found in fetchmail. When fetchmail is run in double verbose\nmode (-v -v), it could crash upon receiving certain, malformed mail\nmessages with long headers. A remote attacker could use this flaw to cause\na denial of service if fetchmail was also running in daemon mode (-d).\n(CVE-2008-2711)\n\nNote: when using SSL-enabled services, it is recommended that the fetchmail\n--sslcertck option be used to enforce strict SSL certificate checking.\n\nAll fetchmail users should upgrade to this updated package, which contains\nbackported patches to correct these issues. If fetchmail is running in\ndaemon mode, it must be restarted for this update to take effect (use the\nfetchmail --quit command to stop the fetchmail process).\";\n\ntag_solution = \"Please note that this update is available via\nRed Hat Network. To use Red Hat Network, launch the Red\nHat Update Agent with the following command: up2date\";\n\n\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.64808\");\n script_version(\"$Revision: 9350 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-04-06 09:03:33 +0200 (Fri, 06 Apr 2018) $\");\n script_tag(name:\"creation_date\", value:\"2009-09-09 02:15:49 +0200 (Wed, 09 Sep 2009)\");\n script_cve_id(\"CVE-2007-4565\", \"CVE-2008-2711\", \"CVE-2009-2666\");\n script_tag(name:\"cvss_base\", value:\"6.4\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:P/I:P/A:N\");\n script_name(\"RedHat Security Advisory RHSA-2009:1427\");\n\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"Red Hat Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/rhel\", \"ssh/login/rpms\");\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_xref(name : \"URL\" , value : \"http://rhn.redhat.com/errata/RHSA-2009-1427.html\");\n script_xref(name : \"URL\" , value : \"http://www.redhat.com/security/updates/classification/#moderate\");\n exit(0);\n}\n\n#\n# The script code starts here\n#\n\ninclude(\"pkg-lib-rpm.inc\");\n\nres = \"\";\nreport = \"\";\nif ((res = isrpmvuln(pkg:\"fetchmail\", rpm:\"fetchmail~6.2.0~3.el3.5\", rls:\"RHENT_3\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"fetchmail-debuginfo\", rpm:\"fetchmail-debuginfo~6.2.0~3.el3.5\", rls:\"RHENT_3\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"fetchmail\", rpm:\"fetchmail~6.2.5~6.0.1.el4_8.1\", rls:\"RHENT_4\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"fetchmail-debuginfo\", rpm:\"fetchmail-debuginfo~6.2.5~6.0.1.el4_8.1\", rls:\"RHENT_4\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"fetchmail\", rpm:\"fetchmail~6.3.6~1.1.el5_3.1\", rls:\"RHENT_5\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"fetchmail-debuginfo\", rpm:\"fetchmail-debuginfo~6.3.6~1.1.el5_3.1\", rls:\"RHENT_5\")) != NULL) {\n report += res;\n}\n\nif (report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 6.4, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:NONE/"}}, {"lastseen": "2019-05-29T18:36:18", "description": "Oracle Linux Local Security Checks ELSA-2009-1427", "cvss3": {}, "published": "2015-10-08T00:00:00", "type": "openvas", "title": "Oracle Linux Local Check: ELSA-2009-1427", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2009-2666", "CVE-2007-4565", "CVE-2008-2711"], "modified": "2018-09-28T00:00:00", "id": "OPENVAS:1361412562310122440", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310122440", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: ELSA-2009-1427.nasl 11688 2018-09-28 13:36:28Z cfischer $\n#\n# Oracle Linux Local Check\n#\n# Authors:\n# Eero Volotinen <eero.volotinen@solinor.com>\n#\n# Copyright:\n# Copyright (c) 2015 Eero Volotinen, http://solinor.com\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.122440\");\n script_version(\"$Revision: 11688 $\");\n script_tag(name:\"creation_date\", value:\"2015-10-08 14:45:26 +0300 (Thu, 08 Oct 2015)\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-09-28 15:36:28 +0200 (Fri, 28 Sep 2018) $\");\n script_name(\"Oracle Linux Local Check: ELSA-2009-1427\");\n script_tag(name:\"insight\", value:\"ELSA-2009-1427 - fetchmail security update. Please see the references for more insight.\");\n script_tag(name:\"solution\", value:\"Update the affected packages to the latest available version.\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"summary\", value:\"Oracle Linux Local Security Checks ELSA-2009-1427\");\n script_xref(name:\"URL\", value:\"http://linux.oracle.com/errata/ELSA-2009-1427.html\");\n script_cve_id(\"CVE-2007-4565\", \"CVE-2008-2711\", \"CVE-2009-2666\");\n script_tag(name:\"cvss_base\", value:\"6.4\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:P/I:P/A:N\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/oracle_linux\", \"ssh/login/release\", re:\"ssh/login/release=OracleLinux5\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Eero Volotinen\");\n script_family(\"Oracle Linux Local Security Checks\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release) exit(0);\n\nres = \"\";\n\nif(release == \"OracleLinux5\")\n{\n if ((res = isrpmvuln(pkg:\"fetchmail\", rpm:\"fetchmail~6.3.6~1.1.el5_3.1\", rls:\"OracleLinux5\")) != NULL) {\n security_message(data:res);\n exit(0);\n }\n\n}\nif (__pkg_match) exit(99);\n exit(0);\n\n", "cvss": {"score": 6.4, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:N"}}, {"lastseen": "2017-07-25T10:55:29", "description": "Check for the Version of fetchmail", "cvss3": {}, "published": "2011-08-09T00:00:00", "type": "openvas", "title": "CentOS Update for fetchmail CESA-2009:1427 centos4 i386", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2009-2666", "CVE-2007-4565", "CVE-2008-2711"], "modified": "2017-07-10T00:00:00", "id": "OPENVAS:880936", "href": "http://plugins.openvas.org/nasl.php?oid=880936", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# CentOS Update for fetchmail CESA-2009:1427 centos4 i386\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (c) 2011 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"Fetchmail is a remote mail retrieval and forwarding utility intended for\n use over on-demand TCP/IP links, such as SLIP and PPP connections.\n\n It was discovered that fetchmail is affected by the previously published\n "null prefix attack", caused by incorrect handling of NULL characters in\n X.509 certificates. If an attacker is able to get a carefully-crafted\n certificate signed by a trusted Certificate Authority, the attacker could\n use the certificate during a man-in-the-middle attack and potentially\n confuse fetchmail into accepting it by mistake. (CVE-2009-2666)\n \n A flaw was found in the way fetchmail handles rejections from a remote SMTP\n server when sending warning mail to the postmaster. If fetchmail sent a\n warning mail to the postmaster of an SMTP server and that SMTP server\n rejected it, fetchmail could crash. (CVE-2007-4565)\n \n A flaw was found in fetchmail. When fetchmail is run in double verbose\n mode ("-v -v"), it could crash upon receiving certain, malformed mail\n messages with long headers. A remote attacker could use this flaw to cause\n a denial of service if fetchmail was also running in daemon mode ("-d").\n (CVE-2008-2711)\n \n Note: when using SSL-enabled services, it is recommended that the fetchmail\n "--sslcertck" option be used to enforce strict SSL certificate checking.\n \n All fetchmail users should upgrade to this updated package, which contains\n backported patches to correct these issues. If fetchmail is running in\n daemon mode, it must be restarted for this update to take effect (use the\n "fetchmail --quit" command to stop the fetchmail process).\";\ntag_solution = \"Please Install the Updated Packages.\";\n\ntag_affected = \"fetchmail on CentOS 4\";\n\n\nif(description)\n{\n script_xref(name : \"URL\" , value : \"http://lists.centos.org/pipermail/centos-announce/2009-September/016128.html\");\n script_id(880936);\n script_version(\"$Revision: 6653 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-07-10 13:46:53 +0200 (Mon, 10 Jul 2017) $\");\n script_tag(name:\"creation_date\", value:\"2011-08-09 08:20:34 +0200 (Tue, 09 Aug 2011)\");\n script_tag(name:\"cvss_base\", value:\"6.4\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:P/I:P/A:N\");\n script_xref(name: \"CESA\", value: \"2009:1427\");\n script_cve_id(\"CVE-2007-4565\", \"CVE-2008-2711\", \"CVE-2009-2666\");\n script_name(\"CentOS Update for fetchmail CESA-2009:1427 centos4 i386\");\n\n script_summary(\"Check for the Version of fetchmail\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2011 Greenbone Networks GmbH\");\n script_family(\"CentOS Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/centos\", \"ssh/login/rpms\");\n script_tag(name : \"affected\" , value : tag_affected);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = get_kb_item(\"ssh/login/release\");\n\n\nres = \"\";\nif(release == NULL){\n exit(0);\n}\n\nif(release == \"CentOS4\")\n{\n\n if ((res = isrpmvuln(pkg:\"fetchmail\", rpm:\"fetchmail~6.2.5~6.0.1.el4_8.1\", rls:\"CentOS4\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}\n", "cvss": {"score": 6.4, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:NONE/"}}, {"lastseen": "2019-05-29T18:39:25", "description": "The remote host is missing an update for the ", "cvss3": {}, "published": "2011-08-09T00:00:00", "type": "openvas", "title": "CentOS Update for fetchmail CESA-2009:1427 centos5 i386", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2009-2666", "CVE-2007-4565", "CVE-2008-2711"], "modified": "2019-03-15T00:00:00", "id": "OPENVAS:1361412562310880813", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310880813", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# CentOS Update for fetchmail CESA-2009:1427 centos5 i386\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (c) 2011 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_xref(name:\"URL\", value:\"http://lists.centos.org/pipermail/centos-announce/2009-October/016226.html\");\n script_oid(\"1.3.6.1.4.1.25623.1.0.880813\");\n script_version(\"$Revision: 14222 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-15 13:50:48 +0100 (Fri, 15 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2011-08-09 08:20:34 +0200 (Tue, 09 Aug 2011)\");\n script_tag(name:\"cvss_base\", value:\"6.4\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:P/I:P/A:N\");\n script_xref(name:\"CESA\", value:\"2009:1427\");\n script_cve_id(\"CVE-2007-4565\", \"CVE-2008-2711\", \"CVE-2009-2666\");\n script_name(\"CentOS Update for fetchmail CESA-2009:1427 centos5 i386\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'fetchmail'\n package(s) announced via the referenced advisory.\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2011 Greenbone Networks GmbH\");\n script_family(\"CentOS Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/centos\", \"ssh/login/rpms\", re:\"ssh/login/release=CentOS5\");\n script_tag(name:\"affected\", value:\"fetchmail on CentOS 5\");\n script_tag(name:\"insight\", value:\"Fetchmail is a remote mail retrieval and forwarding utility intended for\n use over on-demand TCP/IP links, such as SLIP and PPP connections.\n\n It was discovered that fetchmail is affected by the previously published\n 'null prefix attack', caused by incorrect handling of NULL characters in\n X.509 certificates. If an attacker is able to get a carefully-crafted\n certificate signed by a trusted Certificate Authority, the attacker could\n use the certificate during a man-in-the-middle attack and potentially\n confuse fetchmail into accepting it by mistake. (CVE-2009-2666)\n\n A flaw was found in the way fetchmail handles rejections from a remote SMTP\n server when sending warning mail to the postmaster. If fetchmail sent a\n warning mail to the postmaster of an SMTP server and that SMTP server\n rejected it, fetchmail could crash. (CVE-2007-4565)\n\n A flaw was found in fetchmail. When fetchmail is run in double verbose\n mode ('-v -v'), it could crash upon receiving certain, malformed mail\n messages with long headers. A remote attacker could use this flaw to cause\n a denial of service if fetchmail was also running in daemon mode ('-d').\n (CVE-2008-2711)\n\n Note: when using SSL-enabled services, it is recommended that the fetchmail\n '--sslcertck' option be used to enforce strict SSL certificate checking.\n\n All fetchmail users should upgrade to this updated package, which contains\n backported patches to correct these issues. If fetchmail is running in\n daemon mode, it must be restarted for this update to take effect (use the\n 'fetchmail --quit' command to stop the fetchmail process).\");\n script_tag(name:\"solution\", value:\"Please install the updated packages.\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\n\nif(release == \"CentOS5\")\n{\n\n if ((res = isrpmvuln(pkg:\"fetchmail\", rpm:\"fetchmail~6.3.6~1.1.el5_3.1\", rls:\"CentOS5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 6.4, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:N"}}, {"lastseen": "2019-05-29T18:39:28", "description": "The remote host is missing an update for the ", "cvss3": {}, "published": "2011-08-09T00:00:00", "type": "openvas", "title": "CentOS Update for fetchmail CESA-2009:1427 centos4 i386", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2009-2666", "CVE-2007-4565", "CVE-2008-2711"], "modified": "2019-03-15T00:00:00", "id": "OPENVAS:1361412562310880936", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310880936", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# CentOS Update for fetchmail CESA-2009:1427 centos4 i386\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (c) 2011 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_xref(name:\"URL\", value:\"http://lists.centos.org/pipermail/centos-announce/2009-September/016128.html\");\n script_oid(\"1.3.6.1.4.1.25623.1.0.880936\");\n script_version(\"$Revision: 14222 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-15 13:50:48 +0100 (Fri, 15 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2011-08-09 08:20:34 +0200 (Tue, 09 Aug 2011)\");\n script_tag(name:\"cvss_base\", value:\"6.4\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:P/I:P/A:N\");\n script_xref(name:\"CESA\", value:\"2009:1427\");\n script_cve_id(\"CVE-2007-4565\", \"CVE-2008-2711\", \"CVE-2009-2666\");\n script_name(\"CentOS Update for fetchmail CESA-2009:1427 centos4 i386\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'fetchmail'\n package(s) announced via the referenced advisory.\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2011 Greenbone Networks GmbH\");\n script_family(\"CentOS Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/centos\", \"ssh/login/rpms\", re:\"ssh/login/release=CentOS4\");\n script_tag(name:\"affected\", value:\"fetchmail on CentOS 4\");\n script_tag(name:\"insight\", value:\"Fetchmail is a remote mail retrieval and forwarding utility intended for\n use over on-demand TCP/IP links, such as SLIP and PPP connections.\n\n It was discovered that fetchmail is affected by the previously published\n 'null prefix attack', caused by incorrect handling of NULL characters in\n X.509 certificates. If an attacker is able to get a carefully-crafted\n certificate signed by a trusted Certificate Authority, the attacker could\n use the certificate during a man-in-the-middle attack and potentially\n confuse fetchmail into accepting it by mistake. (CVE-2009-2666)\n\n A flaw was found in the way fetchmail handles rejections from a remote SMTP\n server when sending warning mail to the postmaster. If fetchmail sent a\n warning mail to the postmaster of an SMTP server and that SMTP server\n rejected it, fetchmail could crash. (CVE-2007-4565)\n\n A flaw was found in fetchmail. When fetchmail is run in double verbose\n mode ('-v -v'), it could crash upon receiving certain, malformed mail\n messages with long headers. A remote attacker could use this flaw to cause\n a denial of service if fetchmail was also running in daemon mode ('-d').\n (CVE-2008-2711)\n\n Note: when using SSL-enabled services, it is recommended that the fetchmail\n '--sslcertck' option be used to enforce strict SSL certificate checking.\n\n All fetchmail users should upgrade to this updated package, which contains\n backported patches to correct these issues. If fetchmail is running in\n daemon mode, it must be restarted for this update to take effect (use the\n 'fetchmail --quit' command to stop the fetchmail process).\");\n script_tag(name:\"solution\", value:\"Please install the updated packages.\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\n\nif(release == \"CentOS4\")\n{\n\n if ((res = isrpmvuln(pkg:\"fetchmail\", rpm:\"fetchmail~6.2.5~6.0.1.el4_8.1\", rls:\"CentOS4\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 6.4, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:N"}}, {"lastseen": "2017-07-25T10:55:22", "description": "Check for the Version of fetchmail", "cvss3": {}, "published": "2011-08-09T00:00:00", "type": "openvas", "title": "CentOS Update for fetchmail CESA-2009:1427 centos5 i386", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2009-2666", "CVE-2007-4565", "CVE-2008-2711"], "modified": "2017-07-10T00:00:00", "id": "OPENVAS:880813", "href": "http://plugins.openvas.org/nasl.php?oid=880813", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# CentOS Update for fetchmail CESA-2009:1427 centos5 i386\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (c) 2011 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"Fetchmail is a remote mail retrieval and forwarding utility intended for\n use over on-demand TCP/IP links, such as SLIP and PPP connections.\n\n It was discovered that fetchmail is affected by the previously published\n "null prefix attack", caused by incorrect handling of NULL characters in\n X.509 certificates. If an attacker is able to get a carefully-crafted\n certificate signed by a trusted Certificate Authority, the attacker could\n use the certificate during a man-in-the-middle attack and potentially\n confuse fetchmail into accepting it by mistake. (CVE-2009-2666)\n \n A flaw was found in the way fetchmail handles rejections from a remote SMTP\n server when sending warning mail to the postmaster. If fetchmail sent a\n warning mail to the postmaster of an SMTP server and that SMTP server\n rejected it, fetchmail could crash. (CVE-2007-4565)\n \n A flaw was found in fetchmail. When fetchmail is run in double verbose\n mode ("-v -v"), it could crash upon receiving certain, malformed mail\n messages with long headers. A remote attacker could use this flaw to cause\n a denial of service if fetchmail was also running in daemon mode ("-d").\n (CVE-2008-2711)\n \n Note: when using SSL-enabled services, it is recommended that the fetchmail\n "--sslcertck" option be used to enforce strict SSL certificate checking.\n \n All fetchmail users should upgrade to this updated package, which contains\n backported patches to correct these issues. If fetchmail is running in\n daemon mode, it must be restarted for this update to take effect (use the\n "fetchmail --quit" command to stop the fetchmail process).\";\ntag_solution = \"Please Install the Updated Packages.\";\n\ntag_affected = \"fetchmail on CentOS 5\";\n\n\nif(description)\n{\n script_xref(name : \"URL\" , value : \"http://lists.centos.org/pipermail/centos-announce/2009-October/016226.html\");\n script_id(880813);\n script_version(\"$Revision: 6653 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-07-10 13:46:53 +0200 (Mon, 10 Jul 2017) $\");\n script_tag(name:\"creation_date\", value:\"2011-08-09 08:20:34 +0200 (Tue, 09 Aug 2011)\");\n script_tag(name:\"cvss_base\", value:\"6.4\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:P/I:P/A:N\");\n script_xref(name: \"CESA\", value: \"2009:1427\");\n script_cve_id(\"CVE-2007-4565\", \"CVE-2008-2711\", \"CVE-2009-2666\");\n script_name(\"CentOS Update for fetchmail CESA-2009:1427 centos5 i386\");\n\n script_summary(\"Check for the Version of fetchmail\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2011 Greenbone Networks GmbH\");\n script_family(\"CentOS Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/centos\", \"ssh/login/rpms\");\n script_tag(name : \"affected\" , value : tag_affected);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = get_kb_item(\"ssh/login/release\");\n\n\nres = \"\";\nif(release == NULL){\n exit(0);\n}\n\nif(release == \"CentOS5\")\n{\n\n if ((res = isrpmvuln(pkg:\"fetchmail\", rpm:\"fetchmail~6.3.6~1.1.el5_3.1\", rls:\"CentOS5\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}\n", "cvss": {"score": 6.4, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:NONE/"}}, {"lastseen": "2017-07-25T10:56:23", "description": "The remote host is missing updates to fetchmail announced in\nadvisory CESA-2009:1427.", "cvss3": {}, "published": "2009-09-15T00:00:00", "type": "openvas", "title": "CentOS Security Advisory CESA-2009:1427 (fetchmail)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2009-2666", "CVE-2007-4565", "CVE-2008-2711"], "modified": "2017-07-10T00:00:00", "id": "OPENVAS:64900", "href": "http://plugins.openvas.org/nasl.php?oid=64900", "sourceData": "#CESA-2009:1427 64900 8\n# $Id: ovcesa2009_1427.nasl 6650 2017-07-10 11:43:12Z cfischer $\n# Description: Auto-generated from advisory CESA-2009:1427 (fetchmail)\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# or at your option, GNU General Public License version 3,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"For details on the issues addressed in this update,\nplease visit the referenced security advisories.\";\ntag_solution = \"Update the appropriate packages on your system.\n\nhttp://www.securityspace.com/smysecure/catid.html?in=CESA-2009:1427\nhttp://www.securityspace.com/smysecure/catid.html?in=RHSA-2009:1427\nhttps://rhn.redhat.com/errata/RHSA-2009-1427.html\";\ntag_summary = \"The remote host is missing updates to fetchmail announced in\nadvisory CESA-2009:1427.\";\n\n\n\nif(description)\n{\n script_id(64900);\n script_version(\"$Revision: 6650 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-07-10 13:43:12 +0200 (Mon, 10 Jul 2017) $\");\n script_tag(name:\"creation_date\", value:\"2009-09-15 22:46:32 +0200 (Tue, 15 Sep 2009)\");\n script_cve_id(\"CVE-2007-4565\", \"CVE-2008-2711\", \"CVE-2009-2666\");\n script_tag(name:\"cvss_base\", value:\"6.4\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:P/I:P/A:N\");\n script_name(\"CentOS Security Advisory CESA-2009:1427 (fetchmail)\");\n\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"CentOS Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/centos\", \"ssh/login/rpms\");\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n#\n# The script code starts here\n#\n\ninclude(\"pkg-lib-rpm.inc\");\n\nres = \"\";\nreport = \"\";\nif ((res = isrpmvuln(pkg:\"fetchmail\", rpm:\"fetchmail~6.2.0~3.el3.5\", rls:\"CentOS3\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"fetchmail\", rpm:\"fetchmail~6.2.5~6.0.1.el4_8.1\", rls:\"CentOS4\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"fetchmail\", rpm:\"fetchmail~6.3.6~1.1.el5_3.1\", rls:\"CentOS5\")) != NULL) {\n report += res;\n}\n\nif (report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 6.4, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:NONE/"}}, {"lastseen": "2017-07-27T10:55:41", "description": "The remote host is missing updates announced in\nadvisory RHSA-2009:1427.\n\nFetchmail is a remote mail retrieval and forwarding utility intended for\nuse over on-demand TCP/IP links, such as SLIP and PPP connections.\n\nIt was discovered that fetchmail is affected by the previously published\nnull prefix attack, caused by incorrect handling of NULL characters in\nX.509 certificates. If an attacker is able to get a carefully-crafted\ncertificate signed by a trusted Certificate Authority, the attacker could\nuse the certificate during a man-in-the-middle attack and potentially\nconfuse fetchmail into accepting it by mistake. (CVE-2009-2666)\n\nA flaw was found in the way fetchmail handles rejections from a remote SMTP\nserver when sending warning mail to the postmaster. If fetchmail sent a\nwarning mail to the postmaster of an SMTP server and that SMTP server\nrejected it, fetchmail could crash. (CVE-2007-4565)\n\nA flaw was found in fetchmail. When fetchmail is run in double verbose\nmode (-v -v), it could crash upon receiving certain, malformed mail\nmessages with long headers. A remote attacker could use this flaw to cause\na denial of service if fetchmail was also running in daemon mode (-d).\n(CVE-2008-2711)\n\nNote: when using SSL-enabled services, it is recommended that the fetchmail\n--sslcertck option be used to enforce strict SSL certificate checking.\n\nAll fetchmail users should upgrade to this updated package, which contains\nbackported patches to correct these issues. If fetchmail is running in\ndaemon mode, it must be restarted for this update to take effect (use the\nfetchmail --quit command to stop the fetchmail process).", "cvss3": {}, "published": "2009-09-09T00:00:00", "type": "openvas", "title": "RedHat Security Advisory RHSA-2009:1427", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2009-2666", "CVE-2007-4565", "CVE-2008-2711"], "modified": "2017-07-12T00:00:00", "id": "OPENVAS:64808", "href": "http://plugins.openvas.org/nasl.php?oid=64808", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: RHSA_2009_1427.nasl 6683 2017-07-12 09:41:57Z cfischer $\n# Description: Auto-generated from advisory RHSA-2009:1427 ()\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# or at your option, GNU General Public License version 3,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ninclude(\"revisions-lib.inc\");\ntag_summary = \"The remote host is missing updates announced in\nadvisory RHSA-2009:1427.\n\nFetchmail is a remote mail retrieval and forwarding utility intended for\nuse over on-demand TCP/IP links, such as SLIP and PPP connections.\n\nIt was discovered that fetchmail is affected by the previously published\nnull prefix attack, caused by incorrect handling of NULL characters in\nX.509 certificates. If an attacker is able to get a carefully-crafted\ncertificate signed by a trusted Certificate Authority, the attacker could\nuse the certificate during a man-in-the-middle attack and potentially\nconfuse fetchmail into accepting it by mistake. (CVE-2009-2666)\n\nA flaw was found in the way fetchmail handles rejections from a remote SMTP\nserver when sending warning mail to the postmaster. If fetchmail sent a\nwarning mail to the postmaster of an SMTP server and that SMTP server\nrejected it, fetchmail could crash. (CVE-2007-4565)\n\nA flaw was found in fetchmail. When fetchmail is run in double verbose\nmode (-v -v), it could crash upon receiving certain, malformed mail\nmessages with long headers. A remote attacker could use this flaw to cause\na denial of service if fetchmail was also running in daemon mode (-d).\n(CVE-2008-2711)\n\nNote: when using SSL-enabled services, it is recommended that the fetchmail\n--sslcertck option be used to enforce strict SSL certificate checking.\n\nAll fetchmail users should upgrade to this updated package, which contains\nbackported patches to correct these issues. If fetchmail is running in\ndaemon mode, it must be restarted for this update to take effect (use the\nfetchmail --quit command to stop the fetchmail process).\";\n\ntag_solution = \"Please note that this update is available via\nRed Hat Network. To use Red Hat Network, launch the Red\nHat Update Agent with the following command: up2date\";\n\n\n\nif(description)\n{\n script_id(64808);\n script_version(\"$Revision: 6683 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-07-12 11:41:57 +0200 (Wed, 12 Jul 2017) $\");\n script_tag(name:\"creation_date\", value:\"2009-09-09 02:15:49 +0200 (Wed, 09 Sep 2009)\");\n script_cve_id(\"CVE-2007-4565\", \"CVE-2008-2711\", \"CVE-2009-2666\");\n script_tag(name:\"cvss_base\", value:\"6.4\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:P/I:P/A:N\");\n script_name(\"RedHat Security Advisory RHSA-2009:1427\");\n\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"Red Hat Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/rhel\", \"ssh/login/rpms\");\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_xref(name : \"URL\" , value : \"http://rhn.redhat.com/errata/RHSA-2009-1427.html\");\n script_xref(name : \"URL\" , value : \"http://www.redhat.com/security/updates/classification/#moderate\");\n exit(0);\n}\n\n#\n# The script code starts here\n#\n\ninclude(\"pkg-lib-rpm.inc\");\n\nres = \"\";\nreport = \"\";\nif ((res = isrpmvuln(pkg:\"fetchmail\", rpm:\"fetchmail~6.2.0~3.el3.5\", rls:\"RHENT_3\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"fetchmail-debuginfo\", rpm:\"fetchmail-debuginfo~6.2.0~3.el3.5\", rls:\"RHENT_3\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"fetchmail\", rpm:\"fetchmail~6.2.5~6.0.1.el4_8.1\", rls:\"RHENT_4\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"fetchmail-debuginfo\", rpm:\"fetchmail-debuginfo~6.2.5~6.0.1.el4_8.1\", rls:\"RHENT_4\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"fetchmail\", rpm:\"fetchmail~6.3.6~1.1.el5_3.1\", rls:\"RHENT_5\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"fetchmail-debuginfo\", rpm:\"fetchmail-debuginfo~6.3.6~1.1.el5_3.1\", rls:\"RHENT_5\")) != NULL) {\n report += res;\n}\n\nif (report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 6.4, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:NONE/"}}, {"lastseen": "2017-07-25T10:55:46", "description": "Check for the Version of fetchmail", "cvss3": {}, "published": "2011-08-09T00:00:00", "type": "openvas", "title": "CentOS Update for fetchmail CESA-2009:1427 centos3 i386", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2009-2666", "CVE-2007-4565", "CVE-2008-2711"], "modified": "2017-07-10T00:00:00", "id": "OPENVAS:880879", "href": "http://plugins.openvas.org/nasl.php?oid=880879", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# CentOS Update for fetchmail CESA-2009:1427 centos3 i386\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (c) 2011 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"Fetchmail is a remote mail retrieval and forwarding utility intended for\n use over on-demand TCP/IP links, such as SLIP and PPP connections.\n\n It was discovered that fetchmail is affected by the previously published\n "null prefix attack", caused by incorrect handling of NULL characters in\n X.509 certificates. If an attacker is able to get a carefully-crafted\n certificate signed by a trusted Certificate Authority, the attacker could\n use the certificate during a man-in-the-middle attack and potentially\n confuse fetchmail into accepting it by mistake. (CVE-2009-2666)\n \n A flaw was found in the way fetchmail handles rejections from a remote SMTP\n server when sending warning mail to the postmaster. If fetchmail sent a\n warning mail to the postmaster of an SMTP server and that SMTP server\n rejected it, fetchmail could crash. (CVE-2007-4565)\n \n A flaw was found in fetchmail. When fetchmail is run in double verbose\n mode ("-v -v"), it could crash upon receiving certain, malformed mail\n messages with long headers. A remote attacker could use this flaw to cause\n a denial of service if fetchmail was also running in daemon mode ("-d").\n (CVE-2008-2711)\n \n Note: when using SSL-enabled services, it is recommended that the fetchmail\n "--sslcertck" option be used to enforce strict SSL certificate checking.\n \n All fetchmail users should upgrade to this updated package, which contains\n backported patches to correct these issues. If fetchmail is running in\n daemon mode, it must be restarted for this update to take effect (use the\n "fetchmail --quit" command to stop the fetchmail process).\";\ntag_solution = \"Please Install the Updated Packages.\";\n\ntag_affected = \"fetchmail on CentOS 3\";\n\n\nif(description)\n{\n script_xref(name : \"URL\" , value : \"http://lists.centos.org/pipermail/centos-announce/2009-September/016125.html\");\n script_id(880879);\n script_version(\"$Revision: 6653 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-07-10 13:46:53 +0200 (Mon, 10 Jul 2017) $\");\n script_tag(name:\"creation_date\", value:\"2011-08-09 08:20:34 +0200 (Tue, 09 Aug 2011)\");\n script_tag(name:\"cvss_base\", value:\"6.4\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:P/I:P/A:N\");\n script_xref(name: \"CESA\", value: \"2009:1427\");\n script_cve_id(\"CVE-2007-4565\", \"CVE-2008-2711\", \"CVE-2009-2666\");\n script_name(\"CentOS Update for fetchmail CESA-2009:1427 centos3 i386\");\n\n script_summary(\"Check for the Version of fetchmail\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2011 Greenbone Networks GmbH\");\n script_family(\"CentOS Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/centos\", \"ssh/login/rpms\");\n script_tag(name : \"affected\" , value : tag_affected);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = get_kb_item(\"ssh/login/release\");\n\n\nres = \"\";\nif(release == NULL){\n exit(0);\n}\n\nif(release == \"CentOS3\")\n{\n\n if ((res = isrpmvuln(pkg:\"fetchmail\", rpm:\"fetchmail~6.2.0~3.el3.5\", rls:\"CentOS3\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}\n", "cvss": {"score": 6.4, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:NONE/"}}, {"lastseen": "2018-04-06T11:38:13", "description": "The remote host is missing updates to fetchmail announced in\nadvisory CESA-2009:1427.", "cvss3": {}, "published": "2009-09-15T00:00:00", "type": "openvas", "title": "CentOS Security Advisory CESA-2009:1427 (fetchmail)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2009-2666", "CVE-2007-4565", "CVE-2008-2711"], "modified": "2018-04-06T00:00:00", "id": "OPENVAS:136141256231064900", "href": "http://plugins.openvas.org/nasl.php?oid=136141256231064900", "sourceData": "#CESA-2009:1427 64900 8\n# $Id: ovcesa2009_1427.nasl 9350 2018-04-06 07:03:33Z cfischer $\n# Description: Auto-generated from advisory CESA-2009:1427 (fetchmail)\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# or at your option, GNU General Public License version 3,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"For details on the issues addressed in this update,\nplease visit the referenced security advisories.\";\ntag_solution = \"Update the appropriate packages on your system.\n\nhttp://www.securityspace.com/smysecure/catid.html?in=CESA-2009:1427\nhttp://www.securityspace.com/smysecure/catid.html?in=RHSA-2009:1427\nhttps://rhn.redhat.com/errata/RHSA-2009-1427.html\";\ntag_summary = \"The remote host is missing updates to fetchmail announced in\nadvisory CESA-2009:1427.\";\n\n\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.64900\");\n script_version(\"$Revision: 9350 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-04-06 09:03:33 +0200 (Fri, 06 Apr 2018) $\");\n script_tag(name:\"creation_date\", value:\"2009-09-15 22:46:32 +0200 (Tue, 15 Sep 2009)\");\n script_cve_id(\"CVE-2007-4565\", \"CVE-2008-2711\", \"CVE-2009-2666\");\n script_tag(name:\"cvss_base\", value:\"6.4\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:P/I:P/A:N\");\n script_name(\"CentOS Security Advisory CESA-2009:1427 (fetchmail)\");\n\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"CentOS Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/centos\", \"ssh/login/rpms\");\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n#\n# The script code starts here\n#\n\ninclude(\"pkg-lib-rpm.inc\");\n\nres = \"\";\nreport = \"\";\nif ((res = isrpmvuln(pkg:\"fetchmail\", rpm:\"fetchmail~6.2.0~3.el3.5\", rls:\"CentOS3\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"fetchmail\", rpm:\"fetchmail~6.2.5~6.0.1.el4_8.1\", rls:\"CentOS4\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"fetchmail\", rpm:\"fetchmail~6.3.6~1.1.el5_3.1\", rls:\"CentOS5\")) != NULL) {\n report += res;\n}\n\nif (report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 6.4, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:NONE/"}}, {"lastseen": "2018-04-09T11:39:38", "description": "Check for the Version of fetchmail", "cvss3": {}, "published": "2009-04-09T00:00:00", "type": "openvas", "title": "Mandriva Update for fetchmail MDVSA-2008:117 (fetchmail)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2008-2711"], "modified": "2018-04-06T00:00:00", "id": "OPENVAS:1361412562310830610", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310830610", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Mandriva Update for fetchmail MDVSA-2008:117 (fetchmail)\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (c) 2009 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"A flaw in fetchmail was discovered that allowed remote attackers\n to cause a denial of service (crash and persistent mail failure)\n via a malformed message with long headers. The crash only occurred\n when fetchmail was called in '-v -v' mode (CVE-2008-2711).\n\n The updated packages have been patched to prevent this issue.\";\n\ntag_affected = \"fetchmail on Mandriva Linux 2007.1,\n Mandriva Linux 2007.1/X86_64,\n Mandriva Linux 2008.0,\n Mandriva Linux 2008.0/X86_64,\n Mandriva Linux 2008.1,\n Mandriva Linux 2008.1/X86_64\";\ntag_solution = \"Please Install the Updated Packages.\";\n\n\n\nif(description)\n{\n script_xref(name : \"URL\" , value : \"http://lists.mandriva.com/security-announce/2008-06/msg00027.php\");\n script_oid(\"1.3.6.1.4.1.25623.1.0.830610\");\n script_version(\"$Revision: 9370 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-04-06 10:53:14 +0200 (Fri, 06 Apr 2018) $\");\n script_tag(name:\"creation_date\", value:\"2009-04-09 14:26:37 +0200 (Thu, 09 Apr 2009)\");\n script_tag(name:\"cvss_base\", value:\"4.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:N/I:N/A:P\");\n script_xref(name: \"MDVSA\", value: \"2008:117\");\n script_cve_id(\"CVE-2008-2711\");\n script_name( \"Mandriva Update for fetchmail MDVSA-2008:117 (fetchmail)\");\n\n script_tag(name:\"summary\", value:\"Check for the Version of fetchmail\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2009 Greenbone Networks GmbH\");\n script_family(\"Mandrake Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/mandriva_mandrake_linux\", \"ssh/login/release\");\n script_tag(name : \"affected\" , value : tag_affected);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = get_kb_item(\"ssh/login/release\");\n\n\nres = \"\";\nif(release == NULL){\n exit(0);\n}\n\nif(release == \"MNDK_2007.1\")\n{\n\n if ((res = isrpmvuln(pkg:\"fetchmail\", rpm:\"fetchmail~6.3.6~1.3mdv2007.1\", rls:\"MNDK_2007.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"fetchmailconf\", rpm:\"fetchmailconf~6.3.6~1.3mdv2007.1\", rls:\"MNDK_2007.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"fetchmail-daemon\", rpm:\"fetchmail-daemon~6.3.6~1.3mdv2007.1\", rls:\"MNDK_2007.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}\n\n\nif(release == \"MNDK_2008.0\")\n{\n\n if ((res = isrpmvuln(pkg:\"fetchmail\", rpm:\"fetchmail~6.3.8~4.1mdv2008.0\", rls:\"MNDK_2008.0\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"fetchmailconf\", rpm:\"fetchmailconf~6.3.8~4.1mdv2008.0\", rls:\"MNDK_2008.0\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"fetchmail-daemon\", rpm:\"fetchmail-daemon~6.3.8~4.1mdv2008.0\", rls:\"MNDK_2008.0\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}\n\n\nif(release == \"MNDK_2008.1\")\n{\n\n if ((res = isrpmvuln(pkg:\"fetchmail\", rpm:\"fetchmail~6.3.8~7.1mdv2008.1\", rls:\"MNDK_2008.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"fetchmailconf\", rpm:\"fetchmailconf~6.3.8~7.1mdv2008.1\", rls:\"MNDK_2008.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"fetchmail-daemon\", rpm:\"fetchmail-daemon~6.3.8~7.1mdv2008.1\", rls:\"MNDK_2008.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}\n", "cvss": {"score": 4.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}}, {"lastseen": "2019-05-29T18:39:09", "description": "The remote host is missing an update as announced\nvia advisory SSA:2008-210-01.", "cvss3": {}, "published": "2012-09-11T00:00:00", "type": "openvas", "title": "Slackware Advisory SSA:2008-210-01 fetchmail", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2008-2711"], "modified": "2019-03-15T00:00:00", "id": "OPENVAS:136141256231061477", "href": "http://plugins.openvas.org/nasl.php?oid=136141256231061477", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: esoft_slk_ssa_2008_210_01.nasl 14202 2019-03-15 09:16:15Z cfischer $\n# Description: Auto-generated from the corresponding slackware advisory\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2012 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# or at your option, GNU General Public License version 3,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.61477\");\n script_tag(name:\"creation_date\", value:\"2012-09-11 01:34:21 +0200 (Tue, 11 Sep 2012)\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-15 10:16:15 +0100 (Fri, 15 Mar 2019) $\");\n script_cve_id(\"CVE-2008-2711\");\n script_tag(name:\"cvss_base\", value:\"4.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:N/I:N/A:P\");\n script_version(\"$Revision: 14202 $\");\n script_name(\"Slackware Advisory SSA:2008-210-01 fetchmail\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (c) 2012 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"Slackware Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/slackware_linux\", \"ssh/login/slackpack\", re:\"ssh/login/release=SLK(8\\.1|9\\.0|9\\.1|10\\.0|10\\.1|10\\.2|11\\.0|12\\.0|12\\.1)\");\n\n script_xref(name:\"URL\", value:\"https://secure1.securityspace.com/smysecure/catid.html?in=SSA:2008-210-01\");\n\n script_tag(name:\"insight\", value:\"New fetchmail packages are available for Slackware 8.1, 9.0, 9.1, 10.0, 10.1,\n10.2, 11.0, 12.0, 12.1, and -current to fix security issues.\");\n\n script_tag(name:\"solution\", value:\"Upgrade to the new package(s).\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update as announced\nvia advisory SSA:2008-210-01.\");\n\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-slack.inc\");\n\nreport = \"\";\nres = \"\";\n\nif((res = isslkpkgvuln(pkg:\"fetchmail\", ver:\"6.3.8-i386-1_slack8.1\", rls:\"SLK8.1\")) != NULL) {\n report += res;\n}\nif((res = isslkpkgvuln(pkg:\"fetchmail\", ver:\"6.3.8-i386-1_slack9.0\", rls:\"SLK9.0\")) != NULL) {\n report += res;\n}\nif((res = isslkpkgvuln(pkg:\"fetchmail\", ver:\"6.3.8-i486-1_slack9.1\", rls:\"SLK9.1\")) != NULL) {\n report += res;\n}\nif((res = isslkpkgvuln(pkg:\"fetchmail\", ver:\"6.3.8-i486-1_slack10.0\", rls:\"SLK10.0\")) != NULL) {\n report += res;\n}\nif((res = isslkpkgvuln(pkg:\"fetchmail\", ver:\"6.3.8-i486-1_slack10.1\", rls:\"SLK10.1\")) != NULL) {\n report += res;\n}\nif((res = isslkpkgvuln(pkg:\"fetchmail\", ver:\"6.3.8-i486-1_slack10.2\", rls:\"SLK10.2\")) != NULL) {\n report += res;\n}\nif((res = isslkpkgvuln(pkg:\"fetchmail\", ver:\"6.3.8-i486-1_slack11.0\", rls:\"SLK11.0\")) != NULL) {\n report += res;\n}\nif((res = isslkpkgvuln(pkg:\"fetchmail\", ver:\"6.3.8-i486-3_slack12.0\", rls:\"SLK12.0\")) != NULL) {\n report += res;\n}\nif((res = isslkpkgvuln(pkg:\"fetchmail\", ver:\"6.3.8-i486-3_slack12.1\", rls:\"SLK12.1\")) != NULL) {\n report += res;\n}\n\nif(report != \"\") {\n security_message(data:report);\n} else if(__pkg_match) {\n exit(99);\n}", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2017-07-02T21:10:23", "description": "The remote host is missing an update to the system\nas announced in the referenced advisory.", "cvss3": {}, "published": "2008-09-04T00:00:00", "type": "openvas", "title": "FreeBSD Ports: fetchmail", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2008-2711"], "modified": "2016-09-19T00:00:00", "id": "OPENVAS:61189", "href": "http://plugins.openvas.org/nasl.php?oid=61189", "sourceData": "#\n#VID 168190df-3e9a-11dd-87bc-000ea69a5213\n# OpenVAS Vulnerability Test\n# $\n# Description: Auto generated from vuxml or freebsd advisories\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2008 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largely excerpted from the referenced\n# advisories, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"The following package is affected: fetchmail\n\nCVE-2008-2711\nfetchmail 6.3.8 and earlier, when running in -v -v mode, allows remote\nattackers to cause a denial of service (crash and persistent mail\nfailure) via a malformed mail message with long headers, which is not\nproperly handled when using vsnprintf to format log messages.\";\ntag_solution = \"Update your system with the appropriate patches or\nsoftware upgrades.\n\nhttp://fetchmail.berlios.de/fetchmail-SA-2008-01.txt\nhttp://www.vuxml.org/freebsd/168190df-3e9a-11dd-87bc-000ea69a5213.html\";\ntag_summary = \"The remote host is missing an update to the system\nas announced in the referenced advisory.\";\n\n\nif(description)\n{\n script_id(61189);\n script_version(\"$Revision: 4112 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2016-09-19 15:17:59 +0200 (Mon, 19 Sep 2016) $\");\n script_tag(name:\"creation_date\", value:\"2008-09-04 20:41:11 +0200 (Thu, 04 Sep 2008)\");\n script_cve_id(\"CVE-2008-2711\");\n script_tag(name:\"cvss_base\", value:\"4.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:N/I:N/A:P\");\n script_name(\"FreeBSD Ports: fetchmail\");\n\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2008 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"FreeBSD Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/freebsdrel\", \"login/SSH/success\");\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n#\n# The script code starts here\n#\n\ninclude(\"pkg-lib-bsd.inc\");\n\ntxt = \"\";\nvuln = 0;\nbver = portver(pkg:\"fetchmail\");\nif(!isnull(bver) && revcomp(a:bver, b:\"6.3.8_6\")<0) {\n txt += 'Package fetchmail version ' + bver + ' is installed which is known to be vulnerable.\\n';\n vuln = 1;\n}\n\nif(vuln) {\n security_message(data:string(txt));\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 4.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}}, {"lastseen": "2017-07-24T12:51:04", "description": "The remote host is missing an update as announced\nvia advisory SSA:2008-210-01.", "cvss3": {}, "published": "2012-09-11T00:00:00", "type": "openvas", "title": "Slackware Advisory SSA:2008-210-01 fetchmail", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2008-2711"], "modified": "2017-07-07T00:00:00", "id": "OPENVAS:61477", "href": "http://plugins.openvas.org/nasl.php?oid=61477", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: esoft_slk_ssa_2008_210_01.nasl 6598 2017-07-07 09:36:44Z cfischer $\n# Description: Auto-generated from the corresponding slackware advisory\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2012 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# or at your option, GNU General Public License version 3,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"New fetchmail packages are available for Slackware 8.1, 9.0, 9.1, 10.0, 10.1,\n10.2, 11.0, 12.0, 12.1, and -current to fix security issues.\";\ntag_summary = \"The remote host is missing an update as announced\nvia advisory SSA:2008-210-01.\";\n\ntag_solution = \"https://secure1.securityspace.com/smysecure/catid.html?in=SSA:2008-210-01\";\n \nif(description)\n{\n script_id(61477);\n script_tag(name:\"creation_date\", value:\"2012-09-11 01:34:21 +0200 (Tue, 11 Sep 2012)\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-07-07 11:36:44 +0200 (Fri, 07 Jul 2017) $\");\n script_cve_id(\"CVE-2008-2711\");\n script_tag(name:\"cvss_base\", value:\"4.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:N/I:N/A:P\");\n script_version(\"$Revision: 6598 $\");\n name = \"Slackware Advisory SSA:2008-210-01 fetchmail \";\n script_name(name);\n\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2012 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"Slackware Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/slackware_linux\", \"ssh/login/slackpack\");\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n#\n# The script code starts here\n#\n\ninclude(\"pkg-lib-slack.inc\");\nvuln = 0;\nif(isslkpkgvuln(pkg:\"fetchmail\", ver:\"6.3.8-i386-1_slack8.1\", rls:\"SLK8.1\")) {\n vuln = 1;\n}\nif(isslkpkgvuln(pkg:\"fetchmail\", ver:\"6.3.8-i386-1_slack9.0\", rls:\"SLK9.0\")) {\n vuln = 1;\n}\nif(isslkpkgvuln(pkg:\"fetchmail\", ver:\"6.3.8-i486-1_slack9.1\", rls:\"SLK9.1\")) {\n vuln = 1;\n}\nif(isslkpkgvuln(pkg:\"fetchmail\", ver:\"6.3.8-i486-1_slack10.0\", rls:\"SLK10.0\")) {\n vuln = 1;\n}\nif(isslkpkgvuln(pkg:\"fetchmail\", ver:\"6.3.8-i486-1_slack10.1\", rls:\"SLK10.1\")) {\n vuln = 1;\n}\nif(isslkpkgvuln(pkg:\"fetchmail\", ver:\"6.3.8-i486-1_slack10.2\", rls:\"SLK10.2\")) {\n vuln = 1;\n}\nif(isslkpkgvuln(pkg:\"fetchmail\", ver:\"6.3.8-i486-1_slack11.0\", rls:\"SLK11.0\")) {\n vuln = 1;\n}\nif(isslkpkgvuln(pkg:\"fetchmail\", ver:\"6.3.8-i486-3_slack12.0\", rls:\"SLK12.0\")) {\n vuln = 1;\n}\nif(isslkpkgvuln(pkg:\"fetchmail\", ver:\"6.3.8-i486-3_slack12.1\", rls:\"SLK12.1\")) {\n vuln = 1;\n}\n\nif(vuln) {\n security_message(0);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 4.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}}, {"lastseen": "2017-07-02T21:10:25", "description": "The remote host is missing an update to the system\nas announced in the referenced advisory.", "cvss3": {}, "published": "2008-09-04T00:00:00", "type": "openvas", "title": "FreeBSD Ports: fetchmail", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2008-2711"], "modified": "2016-09-19T00:00:00", "id": "OPENVAS:61220", "href": "http://plugins.openvas.org/nasl.php?oid=61220", "sourceData": "#\n#VID 1e8e63c0-478a-11dd-a88d-000ea69a5213\n# OpenVAS Vulnerability Test\n# $\n# Description: Auto generated from vuxml or freebsd advisories\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2008 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largely excerpted from the referenced\n# advisories, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"The following package is affected: fetchmail\n\nCVE-2008-2711\nfetchmail 6.3.8 and earlier, when running in -v -v mode, allows remote\nattackers to cause a denial of service (crash and persistent mail\nfailure) via a malformed mail message with long headers, which is not\nproperly handled when using vsnprintf to format log messages.\";\ntag_solution = \"Update your system with the appropriate patches or\nsoftware upgrades.\n\nhttp://fetchmail.berlios.de/fetchmail-SA-2008-01.txt\nhttp://www.vuxml.org/freebsd/1e8e63c0-478a-11dd-a88d-000ea69a5213.html\";\ntag_summary = \"The remote host is missing an update to the system\nas announced in the referenced advisory.\";\n\n\nif(description)\n{\n script_id(61220);\n script_version(\"$Revision: 4112 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2016-09-19 15:17:59 +0200 (Mon, 19 Sep 2016) $\");\n script_tag(name:\"creation_date\", value:\"2008-09-04 20:41:11 +0200 (Thu, 04 Sep 2008)\");\n script_cve_id(\"CVE-2008-2711\");\n script_tag(name:\"cvss_base\", value:\"4.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:N/I:N/A:P\");\n script_name(\"FreeBSD Ports: fetchmail\");\n\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2008 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"FreeBSD Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/freebsdrel\", \"login/SSH/success\");\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n#\n# The script code starts here\n#\n\ninclude(\"pkg-lib-bsd.inc\");\n\ntxt = \"\";\nvuln = 0;\nbver = portver(pkg:\"fetchmail\");\nif(!isnull(bver) && revcomp(a:bver, b:\"6.3.8_7\")<0) {\n txt += 'Package fetchmail version ' + bver + ' is installed which is known to be vulnerable.\\n';\n vuln = 1;\n}\n\nif(vuln) {\n security_message(data:string(txt));\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 4.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}}, {"lastseen": "2017-07-25T10:56:47", "description": "Check for the Version of fetchmail", "cvss3": {}, "published": "2009-02-17T00:00:00", "type": "openvas", "title": "Fedora Update for fetchmail FEDORA-2008-5789", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2008-2711"], "modified": "2017-07-10T00:00:00", "id": "OPENVAS:860438", "href": "http://plugins.openvas.org/nasl.php?oid=860438", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Fedora Update for fetchmail FEDORA-2008-5789\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (c) 2009 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"Fetchmail is a remote mail retrieval and forwarding utility intended\n for use over on-demand TCP/IP links, like SLIP or PPP connections.\n Fetchmail supports every remote-mail protocol currently in use on the\n Internet (POP2, POP3, RPOP, APOP, KPOP, all IMAPs, ESMTP ETRN, IPv6,\n and IPSEC) for retrieval. Then Fetchmail forwards the mail through\n SMTP so you can read it through your favorite mail client.\n\n Install fetchmail if you need to retrieve mail over SLIP or PPP\n connections.\";\n\ntag_affected = \"fetchmail on Fedora 9\";\ntag_solution = \"Please Install the Updated Packages.\";\n\n\n\nif(description)\n{\n script_xref(name : \"URL\" , value : \"https://www.redhat.com/archives/fedora-package-announce/2008-June/msg01091.html\");\n script_id(860438);\n script_version(\"$Revision: 6623 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-07-10 08:10:20 +0200 (Mon, 10 Jul 2017) $\");\n script_tag(name:\"creation_date\", value:\"2009-02-17 16:50:22 +0100 (Tue, 17 Feb 2009)\");\n script_tag(name:\"cvss_base\", value:\"4.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:N/I:N/A:P\");\n script_xref(name: \"FEDORA\", value: \"2008-5789\");\n script_cve_id(\"CVE-2008-2711\");\n script_name( \"Fedora Update for fetchmail FEDORA-2008-5789\");\n\n script_summary(\"Check for the Version of fetchmail\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2009 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\");\n script_tag(name : \"affected\" , value : tag_affected);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = get_kb_item(\"ssh/login/release\");\n\n\nres = \"\";\nif(release == NULL){\n exit(0);\n}\n\nif(release == \"FC9\")\n{\n\n if ((res = isrpmvuln(pkg:\"fetchmail\", rpm:\"fetchmail~6.3.8~7.fc9\", rls:\"FC9\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}\n", "cvss": {"score": 4.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}}, {"lastseen": "2017-07-25T10:55:57", "description": "Check for the Version of fetchmail", "cvss3": {}, "published": "2009-02-17T00:00:00", "type": "openvas", "title": "Fedora Update for fetchmail FEDORA-2008-5800", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2008-2711"], "modified": "2017-07-10T00:00:00", "id": "OPENVAS:860656", "href": "http://plugins.openvas.org/nasl.php?oid=860656", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Fedora Update for fetchmail FEDORA-2008-5800\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (c) 2009 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"Fetchmail is a remote mail retrieval and forwarding utility intended\n for use over on-demand TCP/IP links, like SLIP or PPP connections.\n Fetchmail supports every remote-mail protocol currently in use on the\n Internet (POP2, POP3, RPOP, APOP, KPOP, all IMAPs, ESMTP ETRN, IPv6,\n and IPSEC) for retrieval. Then Fetchmail forwards the mail through\n SMTP so you can read it through your favorite mail client.\n\n Install fetchmail if you need to retrieve mail over SLIP or PPP\n connections.\";\n\ntag_affected = \"fetchmail on Fedora 8\";\ntag_solution = \"Please Install the Updated Packages.\";\n\n\n\nif(description)\n{\n script_xref(name : \"URL\" , value : \"https://www.redhat.com/archives/fedora-package-announce/2008-June/msg01095.html\");\n script_id(860656);\n script_version(\"$Revision: 6623 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-07-10 08:10:20 +0200 (Mon, 10 Jul 2017) $\");\n script_tag(name:\"creation_date\", value:\"2009-02-17 16:50:22 +0100 (Tue, 17 Feb 2009)\");\n script_tag(name:\"cvss_base\", value:\"4.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:N/I:N/A:P\");\n script_xref(name: \"FEDORA\", value: \"2008-5800\");\n script_cve_id(\"CVE-2008-2711\");\n script_name( \"Fedora Update for fetchmail FEDORA-2008-5800\");\n\n script_summary(\"Check for the Version of fetchmail\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2009 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\");\n script_tag(name : \"affected\" , value : tag_affected);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = get_kb_item(\"ssh/login/release\");\n\n\nres = \"\";\nif(release == NULL){\n exit(0);\n}\n\nif(release == \"FC8\")\n{\n\n if ((res = isrpmvuln(pkg:\"fetchmail\", rpm:\"fetchmail~6.3.8~4.fc8\", rls:\"FC8\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}\n", "cvss": {"score": 4.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}}, {"lastseen": "2017-07-24T12:56:27", "description": "Check for the Version of fetchmail", "cvss3": {}, "published": "2009-04-09T00:00:00", "type": "openvas", "title": "Mandriva Update for fetchmail MDVSA-2008:117 (fetchmail)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2008-2711"], "modified": "2017-07-06T00:00:00", "id": "OPENVAS:830610", "href": "http://plugins.openvas.org/nasl.php?oid=830610", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Mandriva Update for fetchmail MDVSA-2008:117 (fetchmail)\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (c) 2009 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"A flaw in fetchmail was discovered that allowed remote attackers\n to cause a denial of service (crash and persistent mail failure)\n via a malformed message with long headers. The crash only occurred\n when fetchmail was called in '-v -v' mode (CVE-2008-2711).\n\n The updated packages have been patched to prevent this issue.\";\n\ntag_affected = \"fetchmail on Mandriva Linux 2007.1,\n Mandriva Linux 2007.1/X86_64,\n Mandriva Linux 2008.0,\n Mandriva Linux 2008.0/X86_64,\n Mandriva Linux 2008.1,\n Mandriva Linux 2008.1/X86_64\";\ntag_solution = \"Please Install the Updated Packages.\";\n\n\n\nif(description)\n{\n script_xref(name : \"URL\" , value : \"http://lists.mandriva.com/security-announce/2008-06/msg00027.php\");\n script_id(830610);\n script_version(\"$Revision: 6568 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-07-06 15:04:21 +0200 (Thu, 06 Jul 2017) $\");\n script_tag(name:\"creation_date\", value:\"2009-04-09 14:26:37 +0200 (Thu, 09 Apr 2009)\");\n script_tag(name:\"cvss_base\", value:\"4.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:N/I:N/A:P\");\n script_xref(name: \"MDVSA\", value: \"2008:117\");\n script_cve_id(\"CVE-2008-2711\");\n script_name( \"Mandriva Update for fetchmail MDVSA-2008:117 (fetchmail)\");\n\n script_summary(\"Check for the Version of fetchmail\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2009 Greenbone Networks GmbH\");\n script_family(\"Mandrake Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/mandriva_mandrake_linux\", \"ssh/login/release\");\n script_tag(name : \"affected\" , value : tag_affected);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = get_kb_item(\"ssh/login/release\");\n\n\nres = \"\";\nif(release == NULL){\n exit(0);\n}\n\nif(release == \"MNDK_2007.1\")\n{\n\n if ((res = isrpmvuln(pkg:\"fetchmail\", rpm:\"fetchmail~6.3.6~1.3mdv2007.1\", rls:\"MNDK_2007.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"fetchmailconf\", rpm:\"fetchmailconf~6.3.6~1.3mdv2007.1\", rls:\"MNDK_2007.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"fetchmail-daemon\", rpm:\"fetchmail-daemon~6.3.6~1.3mdv2007.1\", rls:\"MNDK_2007.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}\n\n\nif(release == \"MNDK_2008.0\")\n{\n\n if ((res = isrpmvuln(pkg:\"fetchmail\", rpm:\"fetchmail~6.3.8~4.1mdv2008.0\", rls:\"MNDK_2008.0\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"fetchmailconf\", rpm:\"fetchmailconf~6.3.8~4.1mdv2008.0\", rls:\"MNDK_2008.0\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"fetchmail-daemon\", rpm:\"fetchmail-daemon~6.3.8~4.1mdv2008.0\", rls:\"MNDK_2008.0\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}\n\n\nif(release == \"MNDK_2008.1\")\n{\n\n if ((res = isrpmvuln(pkg:\"fetchmail\", rpm:\"fetchmail~6.3.8~7.1mdv2008.1\", rls:\"MNDK_2008.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"fetchmailconf\", rpm:\"fetchmailconf~6.3.8~7.1mdv2008.1\", rls:\"MNDK_2008.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"fetchmail-daemon\", rpm:\"fetchmail-daemon~6.3.8~7.1mdv2008.1\", rls:\"MNDK_2008.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}\n", "cvss": {"score": 4.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}}, {"lastseen": "2018-04-06T11:38:45", "description": "The remote host is missing updates to packages that affect\nthe security of your system. One or more of the following packages\nare affected:\n\n fetchmail\n fetchmailconf\n\n\nMore details may also be found by searching for the SuSE\nEnterprise Server 10 patch database located at\nhttp://download.novell.com/patch/finder/", "cvss3": {}, "published": "2009-10-13T00:00:00", "type": "openvas", "title": "SLES10: Security update for fetchmail", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2007-4565"], "modified": "2018-04-06T00:00:00", "id": "OPENVAS:136141256231065992", "href": "http://plugins.openvas.org/nasl.php?oid=136141256231065992", "sourceData": "#\n#VID slesp1-fetchmail-4462\n# OpenVAS Vulnerability Test\n# $\n# Description: Security update for fetchmail\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largely excerpted from the referenced\n# advisories, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ninclude(\"revisions-lib.inc\");\ntag_summary = \"The remote host is missing updates to packages that affect\nthe security of your system. One or more of the following packages\nare affected:\n\n fetchmail\n fetchmailconf\n\n\nMore details may also be found by searching for the SuSE\nEnterprise Server 10 patch database located at\nhttp://download.novell.com/patch/finder/\";\n\ntag_solution = \"Please install the updates provided by SuSE.\";\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.65992\");\n script_version(\"$Revision: 9350 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-04-06 09:03:33 +0200 (Fri, 06 Apr 2018) $\");\n script_tag(name:\"creation_date\", value:\"2009-10-13 18:25:40 +0200 (Tue, 13 Oct 2009)\");\n script_cve_id(\"CVE-2007-4565\");\n script_tag(name:\"cvss_base\", value:\"5.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n script_name(\"SLES10: Security update for fetchmail\");\n\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"SuSE Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/suse_sles\", \"ssh/login/rpms\");\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n#\n# The script code starts here\n#\n\ninclude(\"pkg-lib-rpm.inc\");\n\nres = \"\";\nreport = \"\";\nif ((res = isrpmvuln(pkg:\"fetchmail\", rpm:\"fetchmail~6.3.2~15.12\", rls:\"SLES10.0\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"fetchmailconf\", rpm:\"fetchmailconf~6.3.2~15.12\", rls:\"SLES10.0\")) != NULL) {\n report += res;\n}\n\nif (report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}}, {"lastseen": "2017-07-24T12:50:15", "description": "The remote host is missing an update to fetchmail\nannounced via advisory DSA 1377-1.", "cvss3": {}, "published": "2008-01-17T00:00:00", "type": "openvas", "title": "Debian Security Advisory DSA 1377-1 (fetchmail)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2007-4565"], "modified": "2017-07-07T00:00:00", "id": "OPENVAS:58615", "href": "http://plugins.openvas.org/nasl.php?oid=58615", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: deb_1377_1.nasl 6616 2017-07-07 12:10:49Z cfischer $\n# Description: Auto-generated from advisory DSA 1377-1\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2007 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largerly excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"Matthias Andree discovered that fetchmail, an SSL enabled POP3, APOP\nand IMAP mail gatherer/forwarder, can under certain circumstances\nattempt to dereference a NULL pointer and crash.\n\nFor the stable distribution (etch), this problem has been fixed in\nversion 6.3.6-1etch1.\n\nFor the old stable distribution (sarge), this problem was not present.\n\nFor the unstable distribution (sid), this problem will be fixed soon.\n\nWe recommend that you upgrade your fetchmail package.\";\ntag_summary = \"The remote host is missing an update to fetchmail\nannounced via advisory DSA 1377-1.\";\n\ntag_solution = \"https://secure1.securityspace.com/smysecure/catid.html?in=DSA%201377-1\";\n\nif(description)\n{\n script_id(58615);\n script_version(\"$Revision: 6616 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-07-07 14:10:49 +0200 (Fri, 07 Jul 2017) $\");\n script_tag(name:\"creation_date\", value:\"2008-01-17 23:19:52 +0100 (Thu, 17 Jan 2008)\");\n script_cve_id(\"CVE-2007-4565\");\n script_tag(name:\"cvss_base\", value:\"5.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n script_name(\"Debian Security Advisory DSA 1377-1 (fetchmail)\");\n\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2007 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"Debian Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/debian_linux\", \"ssh/login/packages\");\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n#\n# The script code starts here\n#\n\ninclude(\"pkg-lib-deb.inc\");\n\nres = \"\";\nreport = \"\";\nif ((res = isdpkgvuln(pkg:\"fetchmailconf\", ver:\"6.3.6-1etch1\", rls:\"DEB4.0\")) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"fetchmail\", ver:\"6.3.6-1etch1\", rls:\"DEB4.0\")) != NULL) {\n report += res;\n}\n\nif (report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}}, {"lastseen": "2017-07-26T08:56:09", "description": "The remote host is missing updates to packages that affect\nthe security of your system. One or more of the following packages\nare affected:\n\n fetchmailconf\n fetchmail\n\nFor more information, please visit the referenced security\nadvisories.\n\nMore details may also be found by searching for keyword\n5015579 within the SuSE Enterprise Server 9 patch\ndatabase at http://download.novell.com/patch/finder/", "cvss3": {}, "published": "2009-10-10T00:00:00", "type": "openvas", "title": "SLES9: Security update for fetchmail", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2007-4565"], "modified": "2017-07-11T00:00:00", "id": "OPENVAS:65548", "href": "http://plugins.openvas.org/nasl.php?oid=65548", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: sles9p5015579.nasl 6666 2017-07-11 13:13:36Z cfischer $\n# Description: Security update for fetchmail\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# or at your option, GNU General Public License version 3,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ninclude(\"revisions-lib.inc\");\ntag_summary = \"The remote host is missing updates to packages that affect\nthe security of your system. One or more of the following packages\nare affected:\n\n fetchmailconf\n fetchmail\n\nFor more information, please visit the referenced security\nadvisories.\n\nMore details may also be found by searching for keyword\n5015579 within the SuSE Enterprise Server 9 patch\ndatabase at http://download.novell.com/patch/finder/\";\n\ntag_solution = \"Please install the updates provided by SuSE.\";\n \nif(description)\n{\n script_id(65548);\n script_version(\"$Revision: 6666 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-07-11 15:13:36 +0200 (Tue, 11 Jul 2017) $\");\n script_tag(name:\"creation_date\", value:\"2009-10-10 16:11:46 +0200 (Sat, 10 Oct 2009)\");\n script_cve_id(\"CVE-2007-4565\");\n script_tag(name:\"cvss_base\", value:\"5.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n script_name(\"SLES9: Security update for fetchmail\");\n\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"SuSE Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/suse_sles\", \"ssh/login/rpms\");\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n#\n# The script code starts here\n#\n\ninclude(\"pkg-lib-rpm.inc\");\n\nres = \"\";\nreport = \"\";\nif ((res = isrpmvuln(pkg:\"fetchmailconf\", rpm:\"fetchmailconf~6.2.5~49.17\", rls:\"SLES9.0\")) != NULL) {\n report += res;\n}\n\nif (report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}}, {"lastseen": "2017-07-26T08:55:43", "description": "The remote host is missing updates to packages that affect\nthe security of your system. One or more of the following packages\nare affected:\n\n fetchmail\n fetchmailconf\n\n\nMore details may also be found by searching for the SuSE\nEnterprise Server 10 patch database located at\nhttp://download.novell.com/patch/finder/", "cvss3": {}, "published": "2009-10-13T00:00:00", "type": "openvas", "title": "SLES10: Security update for fetchmail", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2007-4565"], "modified": "2017-07-11T00:00:00", "id": "OPENVAS:65992", "href": "http://plugins.openvas.org/nasl.php?oid=65992", "sourceData": "#\n#VID slesp1-fetchmail-4462\n# OpenVAS Vulnerability Test\n# $\n# Description: Security update for fetchmail\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largely excerpted from the referenced\n# advisories, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ninclude(\"revisions-lib.inc\");\ntag_summary = \"The remote host is missing updates to packages that affect\nthe security of your system. One or more of the following packages\nare affected:\n\n fetchmail\n fetchmailconf\n\n\nMore details may also be found by searching for the SuSE\nEnterprise Server 10 patch database located at\nhttp://download.novell.com/patch/finder/\";\n\ntag_solution = \"Please install the updates provided by SuSE.\";\n\nif(description)\n{\n script_id(65992);\n script_version(\"$Revision: 6666 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-07-11 15:13:36 +0200 (Tue, 11 Jul 2017) $\");\n script_tag(name:\"creation_date\", value:\"2009-10-13 18:25:40 +0200 (Tue, 13 Oct 2009)\");\n script_cve_id(\"CVE-2007-4565\");\n script_tag(name:\"cvss_base\", value:\"5.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n script_name(\"SLES10: Security update for fetchmail\");\n\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"SuSE Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/suse_sles\", \"ssh/login/rpms\");\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n#\n# The script code starts here\n#\n\ninclude(\"pkg-lib-rpm.inc\");\n\nres = \"\";\nreport = \"\";\nif ((res = isrpmvuln(pkg:\"fetchmail\", rpm:\"fetchmail~6.3.2~15.12\", rls:\"SLES10.0\")) != NULL) {\n report += res;\n}\nif ((res = isrpmvuln(pkg:\"fetchmailconf\", rpm:\"fetchmailconf~6.3.2~15.12\", rls:\"SLES10.0\")) != NULL) {\n report += res;\n}\n\nif (report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}}, {"lastseen": "2017-07-24T12:49:47", "description": "The remote host is missing an update to fetchmail\nannounced via advisory DSA 1377-2.", "cvss3": {}, "published": "2008-01-17T00:00:00", "type": "openvas", "title": "Debian Security Advisory DSA 1377-2 (fetchmail)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2007-4565"], "modified": "2017-07-07T00:00:00", "id": "OPENVAS:58616", "href": "http://plugins.openvas.org/nasl.php?oid=58616", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: deb_1377_2.nasl 6616 2017-07-07 12:10:49Z cfischer $\n# Description: Auto-generated from advisory DSA 1377-2\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2007 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largerly excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"Matthias Andree discovered that fetchmail, an SSL enabled POP3, APOP\nand IMAP mail gatherer/forwarder, can under certain circumstances\nattempt to dereference a NULL pointer and crash.\n\nFor the stable distribution (etch), this problem has been fixed in\nversion 6.3.6-1etch1.\n\nFor the old stable distribution (sarge), this problem was not present.\n\nFor the unstable distribution (sid), this problem will be fixed soon.\n\nWe recommend that you upgrade your fetchmail package.\";\ntag_summary = \"The remote host is missing an update to fetchmail\nannounced via advisory DSA 1377-2.\";\n\ntag_solution = \"https://secure1.securityspace.com/smysecure/catid.html?in=DSA%201377-2\";\n\nif(description)\n{\n script_id(58616);\n script_version(\"$Revision: 6616 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-07-07 14:10:49 +0200 (Fri, 07 Jul 2017) $\");\n script_tag(name:\"creation_date\", value:\"2008-01-17 23:19:52 +0100 (Thu, 17 Jan 2008)\");\n script_cve_id(\"CVE-2007-4565\");\n script_tag(name:\"cvss_base\", value:\"5.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n script_name(\"Debian Security Advisory DSA 1377-2 (fetchmail)\");\n\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2007 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"Debian Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/debian_linux\", \"ssh/login/packages\");\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n#\n# The script code starts here\n#\n\ninclude(\"pkg-lib-deb.inc\");\n\nres = \"\";\nreport = \"\";\nif ((res = isdpkgvuln(pkg:\"fetchmail\", ver:\"6.3.6-1etch1\", rls:\"DEB4.0\")) != NULL) {\n report += res;\n}\n\nif (report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}}, {"lastseen": "2018-04-09T11:38:39", "description": "Check for the Version of fetchmail", "cvss3": {}, "published": "2009-04-09T00:00:00", "type": "openvas", "title": "Mandriva Update for fetchmail MDKSA-2007:179 (fetchmail)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2007-4565"], "modified": "2018-04-06T00:00:00", "id": "OPENVAS:1361412562310830031", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310830031", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Mandriva Update for fetchmail MDKSA-2007:179 (fetchmail)\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (c) 2009 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"A vulnerability in fetchmail was found where it could crash when\n attempting to deliver an internal warning or error message through an\n untrusted or compromised SMTP server, leading to a denial of service.\n\n Updated packages have been patched to prevent these issues.\";\n\ntag_affected = \"fetchmail on Mandriva Linux 2007.0,\n Mandriva Linux 2007.0/X86_64,\n Mandriva Linux 2007.1,\n Mandriva Linux 2007.1/X86_64\";\ntag_solution = \"Please Install the Updated Packages.\";\n\n\n\nif(description)\n{\n script_xref(name : \"URL\" , value : \"http://lists.mandriva.com/security-announce/2007-09/msg00010.php\");\n script_oid(\"1.3.6.1.4.1.25623.1.0.830031\");\n script_version(\"$Revision: 9370 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-04-06 10:53:14 +0200 (Fri, 06 Apr 2018) $\");\n script_tag(name:\"creation_date\", value:\"2009-04-09 13:57:01 +0200 (Thu, 09 Apr 2009)\");\n script_tag(name:\"cvss_base\", value:\"5.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n script_xref(name: \"MDKSA\", value: \"2007:179\");\n script_cve_id(\"CVE-2007-4565\");\n script_name( \"Mandriva Update for fetchmail MDKSA-2007:179 (fetchmail)\");\n\n script_tag(name:\"summary\", value:\"Check for the Version of fetchmail\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2009 Greenbone Networks GmbH\");\n script_family(\"Mandrake Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/mandriva_mandrake_linux\", \"ssh/login/release\");\n script_tag(name : \"affected\" , value : tag_affected);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = get_kb_item(\"ssh/login/release\");\n\n\nres = \"\";\nif(release == NULL){\n exit(0);\n}\n\nif(release == \"MNDK_2007.1\")\n{\n\n if ((res = isrpmvuln(pkg:\"fetchmail\", rpm:\"fetchmail~6.3.6~1.2mdv2007.1\", rls:\"MNDK_2007.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"fetchmail-daemon\", rpm:\"fetchmail-daemon~6.3.6~1.2mdv2007.1\", rls:\"MNDK_2007.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"fetchmailconf\", rpm:\"fetchmailconf~6.3.6~1.2mdv2007.1\", rls:\"MNDK_2007.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}\n\n\nif(release == \"MNDK_2007.0\")\n{\n\n if ((res = isrpmvuln(pkg:\"fetchmail\", rpm:\"fetchmail~6.3.4~3.3mdv2007.0\", rls:\"MNDK_2007.0\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"fetchmail-daemon\", rpm:\"fetchmail-daemon~6.3.4~3.3mdv2007.0\", rls:\"MNDK_2007.0\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"fetchmailconf\", rpm:\"fetchmailconf~6.3.4~3.3mdv2007.0\", rls:\"MNDK_2007.0\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}\n", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}}, {"lastseen": "2018-04-06T11:40:04", "description": "The remote host is missing updates to packages that affect\nthe security of your system. One or more of the following packages\nare affected:\n\n fetchmailconf\n fetchmail\n\nFor more information, please visit the referenced security\nadvisories.\n\nMore details may also be found by searching for keyword\n5015579 within the SuSE Enterprise Server 9 patch\ndatabase at http://download.novell.com/patch/finder/", "cvss3": {}, "published": "2009-10-10T00:00:00", "type": "openvas", "title": "SLES9: Security update for fetchmail", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2007-4565"], "modified": "2018-04-06T00:00:00", "id": "OPENVAS:136141256231065548", "href": "http://plugins.openvas.org/nasl.php?oid=136141256231065548", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: sles9p5015579.nasl 9350 2018-04-06 07:03:33Z cfischer $\n# Description: Security update for fetchmail\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# or at your option, GNU General Public License version 3,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ninclude(\"revisions-lib.inc\");\ntag_summary = \"The remote host is missing updates to packages that affect\nthe security of your system. One or more of the following packages\nare affected:\n\n fetchmailconf\n fetchmail\n\nFor more information, please visit the referenced security\nadvisories.\n\nMore details may also be found by searching for keyword\n5015579 within the SuSE Enterprise Server 9 patch\ndatabase at http://download.novell.com/patch/finder/\";\n\ntag_solution = \"Please install the updates provided by SuSE.\";\n \nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.65548\");\n script_version(\"$Revision: 9350 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-04-06 09:03:33 +0200 (Fri, 06 Apr 2018) $\");\n script_tag(name:\"creation_date\", value:\"2009-10-10 16:11:46 +0200 (Sat, 10 Oct 2009)\");\n script_cve_id(\"CVE-2007-4565\");\n script_tag(name:\"cvss_base\", value:\"5.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n script_name(\"SLES9: Security update for fetchmail\");\n\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2009 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"SuSE Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/suse_sles\", \"ssh/login/rpms\");\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n#\n# The script code starts here\n#\n\ninclude(\"pkg-lib-rpm.inc\");\n\nres = \"\";\nreport = \"\";\nif ((res = isrpmvuln(pkg:\"fetchmailconf\", rpm:\"fetchmailconf~6.2.5~49.17\", rls:\"SLES9.0\")) != NULL) {\n report += res;\n}\n\nif (report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}}, {"lastseen": "2017-07-25T10:56:07", "description": "Check for the Version of fetchmail", "cvss3": {}, "published": "2009-02-27T00:00:00", "type": "openvas", "title": "Fedora Update for fetchmail FEDORA-2007-689", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2007-4565"], "modified": "2017-07-10T00:00:00", "id": "OPENVAS:861535", "href": "http://plugins.openvas.org/nasl.php?oid=861535", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Fedora Update for fetchmail FEDORA-2007-689\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (c) 2009 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"Fetchmail is a remote mail retrieval and forwarding utility intended\n for use over on-demand TCP/IP links, like SLIP or PPP connections.\n Fetchmail supports every remote-mail protocol currently in use on the\n Internet (POP2, POP3, RPOP, APOP, KPOP, all IMAPs, ESMTP ETRN, IPv6,\n and IPSEC) for retrieval. Then Fetchmail forwards the mail through\n SMTP so you can read it through your favorite mail client.\n\n Install fetchmail if you need to retrieve mail over SLIP or PPP\n connections\";\n\ntag_affected = \"fetchmail on Fedora Core 6\";\ntag_solution = \"Please Install the Updated Packages.\";\n\n\n\nif(description)\n{\n script_xref(name : \"URL\" , value : \"https://www.redhat.com/archives/fedora-package-announce/2007-September/msg00099.html\");\n script_id(861535);\n script_version(\"$Revision: 6622 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-07-10 07:52:50 +0200 (Mon, 10 Jul 2017) $\");\n script_tag(name:\"creation_date\", value:\"2009-02-27 16:31:39 +0100 (Fri, 27 Feb 2009)\");\n script_tag(name:\"cvss_base\", value:\"5.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n script_xref(name: \"FEDORA\", value: \"2007-689\");\n script_cve_id(\"CVE-2007-4565\");\n script_name( \"Fedora Update for fetchmail FEDORA-2007-689\");\n\n script_summary(\"Check for the Version of fetchmail\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2009 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora_core\", \"ssh/login/rpms\");\n script_tag(name : \"affected\" , value : tag_affected);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = get_kb_item(\"ssh/login/release\");\n\n\nres = \"\";\nif(release == NULL){\n exit(0);\n}\n\nif(release == \"FC6\")\n{\n\n if ((res = isrpmvuln(pkg:\"fetchmail\", rpm:\"fetchmail~6.3.6~3.fc6\", rls:\"FC6\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"x86_64/debug/fetchmail-debuginfo\", rpm:\"x86_64/debug/fetchmail-debuginfo~6.3.6~3.fc6\", rls:\"FC6\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"x86_64/fetchmail\", rpm:\"x86_64/fetchmail~6.3.6~3.fc6\", rls:\"FC6\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"i386/fetchmail\", rpm:\"i386/fetchmail~6.3.6~3.fc6\", rls:\"FC6\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"i386/debug/fetchmail-debuginfo\", rpm:\"i386/debug/fetchmail-debuginfo~6.3.6~3.fc6\", rls:\"FC6\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}\n", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}}, {"lastseen": "2017-07-25T10:56:52", "description": "Check for the Version of fetchmail", "cvss3": {}, "published": "2009-02-27T00:00:00", "type": "openvas", "title": "Fedora Update for fetchmail FEDORA-2007-1983", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2007-4565"], "modified": "2017-07-10T00:00:00", "id": "OPENVAS:861001", "href": "http://plugins.openvas.org/nasl.php?oid=861001", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Fedora Update for fetchmail FEDORA-2007-1983\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (c) 2009 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"Fetchmail is a remote mail retrieval and forwarding utility intended\n for use over on-demand TCP/IP links, like SLIP or PPP connections.\n Fetchmail supports every remote-mail protocol currently in use on the\n Internet (POP2, POP3, RPOP, APOP, KPOP, all IMAPs, ESMTP ETRN, IPv6,\n and IPSEC) for retrieval. Then Fetchmail forwards the mail through\n SMTP so you can read it through your favorite mail client.\n\n Install fetchmail if you need to retrieve mail over SLIP or PPP\n connections.\";\n\ntag_affected = \"fetchmail on Fedora 7\";\ntag_solution = \"Please Install the Updated Packages.\";\n\n\n\nif(description)\n{\n script_xref(name : \"URL\" , value : \"https://www.redhat.com/archives/fedora-package-announce/2007-September/msg00039.html\");\n script_id(861001);\n script_version(\"$Revision: 6623 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-07-10 08:10:20 +0200 (Mon, 10 Jul 2017) $\");\n script_tag(name:\"creation_date\", value:\"2009-02-27 15:48:41 +0100 (Fri, 27 Feb 2009)\");\n script_tag(name:\"cvss_base\", value:\"5.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n script_xref(name: \"FEDORA\", value: \"2007-1983\");\n script_cve_id(\"CVE-2007-4565\");\n script_name( \"Fedora Update for fetchmail FEDORA-2007-1983\");\n\n script_summary(\"Check for the Version of fetchmail\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2009 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\");\n script_tag(name : \"affected\" , value : tag_affected);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = get_kb_item(\"ssh/login/release\");\n\n\nres = \"\";\nif(release == NULL){\n exit(0);\n}\n\nif(release == \"FC7\")\n{\n\n if ((res = isrpmvuln(pkg:\"fetchmail\", rpm:\"fetchmail~6.3.7~2.fc7\", rls:\"FC7\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"fetchmail-debuginfo\", rpm:\"fetchmail-debuginfo~6.3.7~2.fc7\", rls:\"FC7\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"fetchmail\", rpm:\"fetchmail~6.3.7~2.fc7\", rls:\"FC7\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"fetchmail-debuginfo\", rpm:\"fetchmail-debuginfo~6.3.7~2.fc7\", rls:\"FC7\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"fetchmail\", rpm:\"fetchmail~6.3.7~2.fc7\", rls:\"FC7\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}\n", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}}, {"lastseen": "2017-07-24T12:56:04", "description": "Check for the Version of fetchmail", "cvss3": {}, "published": "2009-04-09T00:00:00", "type": "openvas", "title": "Mandriva Update for fetchmail MDKSA-2007:179 (fetchmail)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2007-4565"], "modified": "2017-07-06T00:00:00", "id": "OPENVAS:830031", "href": "http://plugins.openvas.org/nasl.php?oid=830031", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n#\n# Mandriva Update for fetchmail MDKSA-2007:179 (fetchmail)\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (c) 2009 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"A vulnerability in fetchmail was found where it could crash when\n attempting to deliver an internal warning or error message through an\n untrusted or compromised SMTP server, leading to a denial of service.\n\n Updated packages have been patched to prevent these issues.\";\n\ntag_affected = \"fetchmail on Mandriva Linux 2007.0,\n Mandriva Linux 2007.0/X86_64,\n Mandriva Linux 2007.1,\n Mandriva Linux 2007.1/X86_64\";\ntag_solution = \"Please Install the Updated Packages.\";\n\n\n\nif(description)\n{\n script_xref(name : \"URL\" , value : \"http://lists.mandriva.com/security-announce/2007-09/msg00010.php\");\n script_id(830031);\n script_version(\"$Revision: 6568 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-07-06 15:04:21 +0200 (Thu, 06 Jul 2017) $\");\n script_tag(name:\"creation_date\", value:\"2009-04-09 13:57:01 +0200 (Thu, 09 Apr 2009)\");\n script_tag(name:\"cvss_base\", value:\"5.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n script_xref(name: \"MDKSA\", value: \"2007:179\");\n script_cve_id(\"CVE-2007-4565\");\n script_name( \"Mandriva Update for fetchmail MDKSA-2007:179 (fetchmail)\");\n\n script_summary(\"Check for the Version of fetchmail\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2009 Greenbone Networks GmbH\");\n script_family(\"Mandrake Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/mandriva_mandrake_linux\", \"ssh/login/release\");\n script_tag(name : \"affected\" , value : tag_affected);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = get_kb_item(\"ssh/login/release\");\n\n\nres = \"\";\nif(release == NULL){\n exit(0);\n}\n\nif(release == \"MNDK_2007.1\")\n{\n\n if ((res = isrpmvuln(pkg:\"fetchmail\", rpm:\"fetchmail~6.3.6~1.2mdv2007.1\", rls:\"MNDK_2007.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"fetchmail-daemon\", rpm:\"fetchmail-daemon~6.3.6~1.2mdv2007.1\", rls:\"MNDK_2007.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"fetchmailconf\", rpm:\"fetchmailconf~6.3.6~1.2mdv2007.1\", rls:\"MNDK_2007.1\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}\n\n\nif(release == \"MNDK_2007.0\")\n{\n\n if ((res = isrpmvuln(pkg:\"fetchmail\", rpm:\"fetchmail~6.3.4~3.3mdv2007.0\", rls:\"MNDK_2007.0\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"fetchmail-daemon\", rpm:\"fetchmail-daemon~6.3.4~3.3mdv2007.0\", rls:\"MNDK_2007.0\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"fetchmailconf\", rpm:\"fetchmailconf~6.3.4~3.3mdv2007.0\", rls:\"MNDK_2007.0\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}\n", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}}, {"lastseen": "2017-07-02T21:10:13", "description": "The remote host is missing an update to the system\nas announced in the referenced advisory.", "cvss3": {}, "published": "2008-09-04T00:00:00", "type": "openvas", "title": "FreeBSD Ports: fetchmail", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2007-4565"], "modified": "2016-09-19T00:00:00", "id": "OPENVAS:58808", "href": "http://plugins.openvas.org/nasl.php?oid=58808", "sourceData": "#\n#VID 45500f74-5947-11dc-87c1-000e2e5785ad\n# OpenVAS Vulnerability Test\n# $\n# Description: Auto generated from vuxml or freebsd advisories\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2008 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largely excerpted from the referenced\n# advisories, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"The following package is affected: fetchmail\n\n=====\";\ntag_solution = \"Update your system with the appropriate patches or\nsoftware upgrades.\n\nhttp://www.fetchmail.info/fetchmail-SA-2007-02.txt\nhttp://www.vuxml.org/freebsd/45500f74-5947-11dc-87c1-000e2e5785ad.html\";\ntag_summary = \"The remote host is missing an update to the system\nas announced in the referenced advisory.\";\n\n\nif(description)\n{\n script_id(58808);\n script_version(\"$Revision: 4112 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2016-09-19 15:17:59 +0200 (Mon, 19 Sep 2016) $\");\n script_tag(name:\"creation_date\", value:\"2008-09-04 20:41:11 +0200 (Thu, 04 Sep 2008)\");\n script_cve_id(\"CVE-2007-4565\");\n script_tag(name:\"cvss_base\", value:\"5.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n script_name(\"FreeBSD Ports: fetchmail\");\n\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2007 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"FreeBSD Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/freebsdrel\", \"login/SSH/success\");\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n#\n# The script code starts here\n#\n\ninclude(\"pkg-lib-bsd.inc\");\n\ntxt = \"\";\nvuln = 0;\nbver = portver(pkg:\"fetchmail\");\nif(!isnull(bver) && revcomp(a:bver, b:\"4.6.8\")>=0 && revcomp(a:bver, b:\"6.3.8_4\")<0) {\n txt += 'Package fetchmail version ' + bver + ' is installed which is known to be vulnerable.\\n';\n vuln = 1;\n}\n\nif(vuln) {\n security_message(data:string(txt));\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}}, {"lastseen": "2017-12-04T11:29:07", "description": "Ubuntu Update for Linux kernel vulnerabilities USN-520-1", "cvss3": {}, "published": "2009-03-23T00:00:00", "type": "openvas", "title": "Ubuntu Update for fetchmail vulnerabilities USN-520-1", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2007-1558", "CVE-2007-4565"], "modified": "2017-12-01T00:00:00", "id": "OPENVAS:840065", "href": "http://plugins.openvas.org/nasl.php?oid=840065", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: gb_ubuntu_USN_520_1.nasl 7969 2017-12-01 09:23:16Z santu $\n#\n# Ubuntu Update for fetchmail vulnerabilities USN-520-1\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (c) 2009 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"Gaetan Leurent discovered a vulnerability in the APOP protocol based\n on MD5 collisions. As fetchmail supports the APOP protocol, this\n vulnerability can be used by attackers to discover a portion of the APOP\n user's authentication credentials. (CVE-2007-1558)\n\n Earl Chew discovered that fetchmail can be made to de-reference a NULL\n pointer when contacting SMTP servers. This vulnerability can be used\n by attackers who control the SMTP server to crash fetchmail and cause\n a denial of service. (CVE-2007-4565)\";\n\ntag_summary = \"Ubuntu Update for Linux kernel vulnerabilities USN-520-1\";\ntag_affected = \"fetchmail vulnerabilities on Ubuntu 6.06 LTS ,\n Ubuntu 6.10 ,\n Ubuntu 7.04\";\ntag_solution = \"Please Install the Updated Packages.\";\n\n\n\nif(description)\n{\n script_xref(name: \"URL\" , value: \"http://www.ubuntu.com/usn/usn-520-1/\");\n script_id(840065);\n script_version(\"$Revision: 7969 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-12-01 10:23:16 +0100 (Fri, 01 Dec 2017) $\");\n script_tag(name:\"creation_date\", value:\"2009-03-23 10:59:50 +0100 (Mon, 23 Mar 2009)\");\n script_tag(name:\"cvss_base\", value:\"5.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n script_xref(name: \"USN\", value: \"520-1\");\n script_cve_id(\"CVE-2007-1558\", \"CVE-2007-4565\");\n script_name( \"Ubuntu Update for fetchmail vulnerabilities USN-520-1\");\n\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2009 Greenbone Networks GmbH\");\n script_family(\"Ubuntu Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/ubuntu_linux\", \"ssh/login/packages\");\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name : \"affected\" , value : tag_affected);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n\ninclude(\"pkg-lib-deb.inc\");\n\nrelease = get_kb_item(\"ssh/login/release\");\n\n\nres = \"\";\nif(release == NULL){\n exit(0);\n}\n\nif(release == \"UBUNTU7.04\")\n{\n\n if ((res = isdpkgvuln(pkg:\"fetchmail\", ver:\"6.3.6-1ubuntu2.1\", rls:\"UBUNTU7.04\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"fetchmailconf\", ver:\"6.3.6-1ubuntu2.1\", rls:\"UBUNTU7.04\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}\n\n\nif(release == \"UBUNTU6.06 LTS\")\n{\n\n if ((res = isdpkgvuln(pkg:\"fetchmail\", ver:\"6.3.2-2ubuntu2.2\", rls:\"UBUNTU6.06 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"fetchmailconf\", ver:\"6.3.2-2ubuntu2.2\", rls:\"UBUNTU6.06 LTS\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}\n\n\nif(release == \"UBUNTU6.10\")\n{\n\n if ((res = isdpkgvuln(pkg:\"fetchmail\", ver:\"6.3.4-1ubuntu4.2\", rls:\"UBUNTU6.10\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isdpkgvuln(pkg:\"fetchmailconf\", ver:\"6.3.4-1ubuntu4.2\", rls:\"UBUNTU6.10\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99); # Not vulnerable.\n exit(0);\n}\n", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}}, {"lastseen": "2017-07-02T21:09:59", "description": "The remote host is missing Security Update 2009-001.\n One or more of the following components are affected:\n\n AFP Server\n Apple Pixlet Video\n CarbonCore\n CFNetwork\n Certificate Assistant\n ClamAV\n CoreText\n CUPS\n DS Tools\n fetchmail\n Folder Manager\n FSEvents\n Network Time\n perl\n Printing\n python\n Remote Apple Events\n Safari RSS\n servermgrd\n SMB\n SquirrelMail\n X11\n XTerm", "cvss3": {}, "published": "2010-05-12T00:00:00", "type": "openvas", "title": "Mac OS X Security Update 2009-001", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2008-5050", "CVE-2008-2362", "CVE-2009-0137", "CVE-2008-1927", "CVE-2009-0139", "CVE-2009-0017", "CVE-2009-0014", "CVE-2008-1379", "CVE-2008-1721", "CVE-2007-1667", "CVE-2008-4864", "CVE-2009-0138", "CVE-2009-0011", "CVE-2008-2316", "CVE-2009-0019", "CVE-2007-1351", "CVE-2008-3663", "CVE-2008-1808", "CVE-2009-0013", "CVE-2007-4565", "CVE-2007-4965", "CVE-2009-0015", "CVE-2007-1352", "CVE-2008-2711", "CVE-2008-3144", "CVE-2008-5183", "CVE-2009-0018", "CVE-2008-1377", "CVE-2006-3467", "CVE-2008-3142", "CVE-2009-0012", "CVE-2009-0141", "CVE-2006-1861", "CVE-2009-0142", "CVE-2008-2315", "CVE-2008-2379", "CVE-2008-1679", "CVE-2009-0140", "CVE-2008-2361", "CVE-2008-1887", "CVE-2008-2360", "CVE-2008-1807", "CVE-2008-5031", "CVE-2009-0020", "CVE-2008-1806", "CVE-2009-0009", "CVE-2008-5314"], "modified": "2017-02-22T00:00:00", "id": "OPENVAS:102026", "href": "http://plugins.openvas.org/nasl.php?oid=102026", "sourceData": "###################################################################\n# OpenVAS Vulnerability Test\n#\n# Mac OS X Security Update 2009-001\n#\n# LSS-NVT-2010-015\n#\n# Developed by LSS Security Team <http://security.lss.hr>\n#\n# Copyright (C) 2010 LSS <http://www.lss.hr>\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public\n# License along with this program. If not, see\n# <http://www.gnu.org/licenses/>.\n###################################################################\n\ntag_solution = \"Update your Mac OS X operating system.\n\n For more information see:\n http://support.apple.com/kb/HT3438\";\n\ntag_summary = \"The remote host is missing Security Update 2009-001.\n One or more of the following components are affected:\n\n AFP Server\n Apple Pixlet Video\n CarbonCore\n CFNetwork\n Certificate Assistant\n ClamAV\n CoreText\n CUPS\n DS Tools\n fetchmail\n Folder Manager\n FSEvents\n Network Time\n perl\n Printing\n python\n Remote Apple Events\n Safari RSS\n servermgrd\n SMB\n SquirrelMail\n X11\n XTerm\";\n\n\nif(description)\n{\n script_id(102026);\n script_version(\"$Revision: 5394 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-02-22 10:22:42 +0100 (Wed, 22 Feb 2017) $\");\n script_tag(name:\"creation_date\", value:\"2010-05-12 14:48:44 +0200 (Wed, 12 May 2010)\");\n script_cve_id(\"CVE-2009-0142\",\"CVE-2009-0009\",\"CVE-2009-0020\",\"CVE-2009-0011\",\"CVE-2008-5050\",\"CVE-2008-5314\",\"CVE-2009-0012\",\"CVE-2008-5183\",\"CVE-2009-0013\",\"CVE-2007-4565\",\"CVE-2008-2711\",\"CVE-2009-0014\",\"CVE-2009-0015\",\"CVE-2008-1927\",\"CVE-2009-0017\",\"CVE-2008-1679\",\"CVE-2008-1721\",\"CVE-2008-1887\",\"CVE-2008-2315\",\"CVE-2008-2316\",\"CVE-2008-3142\",\"CVE-2008-3144\",\"CVE-2008-4864\",\"CVE-2007-4965\",\"CVE-2008-5031\",\"CVE-2009-0018\",\"CVE-2009-0019\",\"CVE-2009-0137\",\"CVE-2009-0138\",\"CVE-2009-0139\",\"CVE-2009-0140\",\"CVE-2008-2379\",\"CVE-2008-3663\",\"CVE-2008-1377\",\"CVE-2008-1379\",\"CVE-2008-2360\",\"CVE-2008-2361\",\"CVE-2008-2362\",\"CVE-2006-1861\",\"CVE-2006-3467\",\"CVE-2007-1351\",\"CVE-2008-1806\",\"CVE-2008-1807\",\"CVE-2008-1808\",\"CVE-2007-1352\",\"CVE-2007-1667\",\"CVE-2009-0141\");\n script_name(\"Mac OS X Security Update 2009-001\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2010 LSS\");\n script_family(\"Mac OS X Local Security Checks\");\n script_require_ports(\"Services/ssh\", 22);\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/osx_name\",\"ssh/login/osx_version\");\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\ninclude(\"pkg-lib-macosx.inc\");\ninclude(\"version_func.inc\");\n\nssh_osx_name = get_kb_item(\"ssh/login/osx_name\");\nif (!ssh_osx_name) exit (0);\n\nssh_osx_ver = get_kb_item(\"ssh/login/osx_version\");\nif (!ssh_osx_ver) exit (0);\n\nssh_osx_rls = ssh_osx_name + ' ' + ssh_osx_ver;\n\npkg_for_ver = make_list(\"Mac OS X 10.5.6\",\"Mac OS X Server 10.5.6\",\"Mac OS X 10.4.11\",\"Mac OS X Server 10.4.11\");\n\nif (rlsnotsupported(rls:ssh_osx_rls, list:pkg_for_ver)) { security_message(0); exit(0);}\n\nif (osx_rls_name(rls:ssh_osx_rls) == osx_rls_name(rls:\"Mac OS X 10.5.6\")) {\n if (version_is_less(version:osx_ver(ver:ssh_osx_rls), test_version:osx_ver(ver:\"Mac OS X 10.5.6\"))) { security_message(0); exit(0);}\n else if ((ssh_osx_ver==osx_ver(ver:\"Mac OS X 10.5.6\")) && (isosxpkgvuln(fixed:\"com.apple.pkg.update.security.\", diff:\"2009.001\"))) { security_message(0); exit(0);}\n}\nif (osx_rls_name(rls:ssh_osx_rls) == osx_rls_name(rls:\"Mac OS X Server 10.5.6\")) {\n if (version_is_less(version:osx_ver(ver:ssh_osx_rls), test_version:osx_ver(ver:\"Mac OS X Server 10.5.6\"))) { security_message(0); exit(0);}\n else if ((ssh_osx_ver==osx_ver(ver:\"Mac OS X Server 10.5.6\")) && (isosxpkgvuln(fixed:\"com.apple.pkg.update.security.\", diff:\"2009.001\"))) { security_message(0); exit(0);}\n}\nif (osx_rls_name(rls:ssh_osx_rls) == osx_rls_name(rls:\"Mac OS X 10.4.11\")) {\n if (version_is_less(version:osx_ver(ver:ssh_osx_rls), test_version:osx_ver(ver:\"Mac OS X 10.4.11\"))) { security_message(0); exit(0);}\n else if ((ssh_osx_ver==osx_ver(ver:\"Mac OS X 10.4.11\")) && (isosxpkgvuln(fixed:\"com.apple.pkg.update.security.\", diff:\"2009.001\"))) { security_message(0); exit(0);}\n}\nif (osx_rls_name(rls:ssh_osx_rls) == osx_rls_name(rls:\"Mac OS X Server 10.4.11\")) {\n if (version_is_less(version:osx_ver(ver:ssh_osx_rls), test_version:osx_ver(ver:\"Mac OS X Server 10.4.11\"))) { security_message(0); exit(0);}\n else if ((ssh_osx_ver==osx_ver(ver:\"Mac OS X Server 10.4.11\")) && (isosxpkgvuln(fixed:\"com.apple.pkg.update.security.\", diff:\"2009.001\"))) { security_message(0); exit(0);}\n}\n", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2019-05-29T18:40:09", "description": "The remote host is missing Security Update 2009-001.", "cvss3": {}, "published": "2010-05-12T00:00:00", "type": "openvas", "title": "Mac OS X Security Update 2009-001", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2008-5050", "CVE-2008-2362", "CVE-2009-0137", "CVE-2008-1927", "CVE-2009-0139", "CVE-2009-0017", "CVE-2009-0014", "CVE-2008-1379", "CVE-2008-1721", "CVE-2007-1667", "CVE-2008-4864", "CVE-2009-0138", "CVE-2009-0011", "CVE-2008-2316", "CVE-2009-0019", "CVE-2007-1351", "CVE-2008-3663", "CVE-2008-1808", "CVE-2009-0013", "CVE-2007-4565", "CVE-2007-4965", "CVE-2009-0015", "CVE-2007-1352", "CVE-2008-2711", "CVE-2008-3144", "CVE-2008-5183", "CVE-2009-0018", "CVE-2008-1377", "CVE-2006-3467", "CVE-2008-3142", "CVE-2009-0012", "CVE-2009-0141", "CVE-2006-1861", "CVE-2009-0142", "CVE-2008-2315", "CVE-2008-2379", "CVE-2008-1679", "CVE-2009-0140", "CVE-2008-2361", "CVE-2008-1887", "CVE-2008-2360", "CVE-2008-1807", "CVE-2008-5031", "CVE-2009-0020", "CVE-2008-1806", "CVE-2009-0009", "CVE-2008-5314"], "modified": "2019-03-19T00:00:00", "id": "OPENVAS:1361412562310102026", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310102026", "sourceData": "###################################################################\n# OpenVAS Vulnerability Test\n# $Id: macosx_secupd_2009-001.nasl 14307 2019-03-19 10:09:27Z cfischer $\n#\n# Mac OS X Security Update 2009-001\n#\n# LSS-NVT-2010-015\n#\n# Developed by LSS Security Team <http://security.lss.hr>\n#\n# Copyright (C) 2010 LSS <http://www.lss.hr>\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public\n# License along with this program. If not, see\n# <http://www.gnu.org/licenses/>.\n###################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.102026\");\n script_version(\"$Revision: 14307 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-19 11:09:27 +0100 (Tue, 19 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2010-05-12 14:48:44 +0200 (Wed, 12 May 2010)\");\n script_cve_id(\"CVE-2009-0142\", \"CVE-2009-0009\", \"CVE-2009-0020\", \"CVE-2009-0011\", \"CVE-2008-5050\",\n \"CVE-2008-5314\", \"CVE-2009-0012\", \"CVE-2008-5183\", \"CVE-2009-0013\", \"CVE-2007-4565\",\n \"CVE-2008-2711\", \"CVE-2009-0014\", \"CVE-2009-0015\", \"CVE-2008-1927\", \"CVE-2009-0017\",\n \"CVE-2008-1679\", \"CVE-2008-1721\", \"CVE-2008-1887\", \"CVE-2008-2315\", \"CVE-2008-2316\",\n \"CVE-2008-3142\", \"CVE-2008-3144\", \"CVE-2008-4864\", \"CVE-2007-4965\", \"CVE-2008-5031\",\n \"CVE-2009-0018\", \"CVE-2009-0019\", \"CVE-2009-0137\", \"CVE-2009-0138\", \"CVE-2009-0139\",\n \"CVE-2009-0140\", \"CVE-2008-2379\", \"CVE-2008-3663\", \"CVE-2008-1377\", \"CVE-2008-1379\",\n \"CVE-2008-2360\", \"CVE-2008-2361\", \"CVE-2008-2362\", \"CVE-2006-1861\", \"CVE-2006-3467\",\n \"CVE-2007-1351\", \"CVE-2008-1806\", \"CVE-2008-1807\", \"CVE-2008-1808\", \"CVE-2007-1352\",\n \"CVE-2007-1667\", \"CVE-2009-0141\");\n script_name(\"Mac OS X Security Update 2009-001\");\n script_tag(name:\"cvss_base\", value:\"10.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2010 LSS\");\n script_family(\"Mac OS X Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/osx_name\", \"ssh/login/osx_version\", re:\"ssh/login/osx_version=^10\\.[45]\\.\");\n\n script_xref(name:\"URL\", value:\"http://support.apple.com/kb/HT3438\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing Security Update 2009-001.\");\n\n script_tag(name:\"affected\", value:\"One or more of the following components are affected:\n\n AFP Server\n\n Apple Pixlet Video\n\n CarbonCore\n\n CFNetwork\n\n Certificate Assistant\n\n ClamAV\n\n CoreText\n\n CUPS\n\n DS Tools\n\n fetchmail\n\n Folder Manager\n\n FSEvents\n\n Network Time\n\n perl\n\n Printing\n\n python\n\n Remote Apple Events\n\n Safari RSS\n\n servermgrd\n\n SMB\n\n SquirrelMail\n\n X11\n\n XTerm\");\n\n script_tag(name:\"solution\", value:\"Update your Mac OS X operating system. Please see the references for more information.\");\n\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n\n exit(0);\n}\n\ninclude(\"pkg-lib-macosx.inc\");\ninclude(\"version_func.inc\");\n\nssh_osx_name = get_kb_item(\"ssh/login/osx_name\");\nif (!ssh_osx_name) exit (0);\n\nssh_osx_ver = get_kb_item(\"ssh/login/osx_version\");\nif (!ssh_osx_ver || ssh_osx_ver !~ \"^10\\.[45]\\.\") exit (0);\n\nssh_osx_rls = ssh_osx_name + ' ' + ssh_osx_ver;\n\npkg_for_ver = make_list(\"Mac OS X 10.5.6\",\"Mac OS X Server 10.5.6\",\"Mac OS X 10.4.11\",\"Mac OS X Server 10.4.11\");\n\nif (rlsnotsupported(rls:ssh_osx_rls, list:pkg_for_ver)) { security_message( port: 0, data: \"The target host was found to be vulnerable\" ); exit(0);}\n\nif (osx_rls_name(rls:ssh_osx_rls) == osx_rls_name(rls:\"Mac OS X 10.5.6\")) {\n if(version_is_less(version:osx_ver(ver:ssh_osx_rls), test_version:osx_ver(ver:\"Mac OS X 10.5.6\"))) { security_message( port: 0, data: \"The target host was found to be vulnerable\" ); exit(0);}\n else if((ssh_osx_ver == osx_ver(ver:\"Mac OS X 10.5.6\")) && (isosxpkgvuln(fixed:\"com.apple.pkg.update.security.\", diff:\"2009.001\"))) { security_message( port: 0, data: \"The target host was found to be vulnerable\" ); exit(0);}\n}\nif (osx_rls_name(rls:ssh_osx_rls) == osx_rls_name(rls:\"Mac OS X Server 10.5.6\")) {\n if(version_is_less(version:osx_ver(ver:ssh_osx_rls), test_version:osx_ver(ver:\"Mac OS X Server 10.5.6\"))) { security_message( port: 0, data: \"The target host was found to be vulnerable\" ); exit(0);}\n else if((ssh_osx_ver == osx_ver(ver:\"Mac OS X Server 10.5.6\")) && (isosxpkgvuln(fixed:\"com.apple.pkg.update.security.\", diff:\"2009.001\"))) { security_message( port: 0, data: \"The target host was found to be vulnerable\" ); exit(0);}\n}\nif (osx_rls_name(rls:ssh_osx_rls) == osx_rls_name(rls:\"Mac OS X 10.4.11\")) {\n if(version_is_less(version:osx_ver(ver:ssh_osx_rls), test_version:osx_ver(ver:\"Mac OS X 10.4.11\"))) { security_message( port: 0, data: \"The target host was found to be vulnerable\" ); exit(0);}\n else if((ssh_osx_ver == osx_ver(ver:\"Mac OS X 10.4.11\")) && (isosxpkgvuln(fixed:\"com.apple.pkg.update.security.\", diff:\"2009.001\"))) { security_message( port: 0, data: \"The target host was found to be vulnerable\" ); exit(0);}\n}\nif (osx_rls_name(rls:ssh_osx_rls) == osx_rls_name(rls:\"Mac OS X Server 10.4.11\")) {\n if(version_is_less(version:osx_ver(ver:ssh_osx_rls), test_version:osx_ver(ver:\"Mac OS X Server 10.4.11\"))) { security_message( port: 0, data: \"The target host was found to be vulnerable\" ); exit(0);}\n else if((ssh_osx_ver == osx_ver(ver:\"Mac OS X Server 10.4.11\")) && (isosxpkgvuln(fixed:\"com.apple.pkg.update.security.\", diff:\"2009.001\"))) { security_message( port: 0, data: \"The target host was found to be vulnerable\" ); exit(0);}\n}\n", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}], "oraclelinux": [{"lastseen": "2019-05-29T18:37:23", "description": "[6.3.6-1.1.el5_3.1]\n- Fix fetchmail various flaws (CVE-2007-4565, CVE-2008-2711, CVE-2009-2666)\n Resolves: #516269", "cvss3": {}, "published": "2009-09-09T00:00:00", "type": "oraclelinux", "title": "fetchmail security update", "bulletinFamily": "unix", "cvss2": {}, "cvelist": ["CVE-2009-2666", "CVE-2007-4565", "CVE-2008-2711"], "modified": "2009-09-09T00:00:00", "id": "ELSA-2009-1427", "href": "http://linux.oracle.com/errata/ELSA-2009-1427.html", "cvss": {"score": 6.4, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:N"}}], "redhat": [{"lastseen": "2021-10-21T04:43:48", "description": "Fetchmail is a remote mail retrieval and forwarding utility intended for\nuse over on-demand TCP/IP links, such as SLIP and PPP connections.\n\nIt was discovered that fetchmail is affected by the previously published\n\"null prefix attack\", caused by incorrect handling of NULL characters in\nX.509 certificates. If an attacker is able to get a carefully-crafted\ncertificate signed by a trusted Certificate Authority, the attacker could\nuse the certificate during a man-in-the-middle attack and potentially\nconfuse fetchmail into accepting it by mistake. (CVE-2009-2666)\n\nA flaw was found in the way fetchmail handles rejections from a remote SMTP\nserver when sending warning mail to the postmaster. If fetchmail sent a\nwarning mail to the postmaster of an SMTP server and that SMTP server\nrejected it, fetchmail could crash. (CVE-2007-4565)\n\nA flaw was found in fetchmail. When fetchmail is run in double verbose\nmode (\"-v -v\"), it could crash upon receiving certain, malformed mail\nmessages with long headers. A remote attacker could use this flaw to cause\na denial of service if fetchmail was also running in daemon mode (\"-d\").\n(CVE-2008-2711)\n\nNote: when using SSL-enabled services, it is recommended that the fetchmail\n\"--sslcertck\" option be used to enforce strict SSL certificate checking.\n\nAll fetchmail users should upgrade to this updated package, which contains\nbackported patches to correct these issues. If fetchmail is running in\ndaemon mode, it must be restarted for this update to take effect (use the\n\"fetchmail --quit\" command to stop the fetchmail process).", "cvss3": {}, "published": "2009-09-08T00:00:00", "type": "redhat", "title": "(RHSA-2009:1427) Moderate: fetchmail security update", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 6.4, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 4.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2007-4565", "CVE-2008-2711", "CVE-2009-2666"], "modified": "2018-05-26T00:26:17", "id": "RHSA-2009:1427", "href": "https://access.redhat.com/errata/RHSA-2009:1427", "cvss": {"score": 6.4, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:N"}}], "nessus": [{"lastseen": "2023-05-18T14:26:16", "description": "An updated fetchmail package that fixes multiple security issues is now available for Red Hat Enterprise Linux 3, 4, and 5.\n\nThis update has been rated as having moderate security impact by the Red Hat Security Response Team.\n\nFetchmail is a remote mail retrieval and forwarding utility intended for use over on-demand TCP/IP links, such as SLIP and PPP connections.\n\nIt was discovered that fetchmail is affected by the previously published 'null prefix attack', caused by incorrect handling of NULL characters in X.509 certificates. If an attacker is able to get a carefully-crafted certificate signed by a trusted Certificate Authority, the attacker could use the certificate during a man-in-the-middle attack and potentially confuse fetchmail into accepting it by mistake. (CVE-2009-2666)\n\nA flaw was found in the way fetchmail handles rejections from a remote SMTP server when sending warning mail to the postmaster. If fetchmail sent a warning mail to the postmaster of an SMTP server and that SMTP server rejected it, fetchmail could crash. (CVE-2007-4565)\n\nA flaw was found in fetchmail. When fetchmail is run in double verbose mode ('-v -v'), it could crash upon receiving certain, malformed mail messages with long headers. A remote attacker could use this flaw to cause a denial of service if fetchmail was also running in daemon mode ('-d'). (CVE-2008-2711)\n\nNote: when using SSL-enabled services, it is recommended that the fetchmail '--sslcertck' option be used to enforce strict SSL certificate checking.\n\nAll fetchmail users should upgrade to this updated package, which contains backported patches to correct these issues. If fetchmail is running in daemon mode, it must be restarted for this update to take effect (use the 'fetchmail --quit' command to stop the fetchmail process).", "cvss3": {}, "published": "2009-09-09T00:00:00", "type": "nessus", "title": "CentOS 3 / 4 / 5 : fetchmail (CESA-2009:1427)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2007-4565", "CVE-2008-2711", "CVE-2009-2666"], "modified": "2021-01-04T00:00:00", "cpe": ["p-cpe:/a:centos:centos:fetchmail", "cpe:/o:centos:centos:3", "cpe:/o:centos:centos:4", "cpe:/o:centos:centos:5"], "id": "CENTOS_RHSA-2009-1427.NASL", "href": "https://www.tenable.com/plugins/nessus/40893", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Red Hat Security Advisory RHSA-2009:1427 and \n# CentOS Errata and Security Advisory 2009:1427 respectively.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(40893);\n script_version(\"1.19\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/04\");\n\n script_cve_id(\"CVE-2007-4565\", \"CVE-2008-2711\", \"CVE-2009-2666\");\n script_bugtraq_id(25495, 29705);\n script_xref(name:\"RHSA\", value:\"2009:1427\");\n\n script_name(english:\"CentOS 3 / 4 / 5 : fetchmail (CESA-2009:1427)\");\n script_summary(english:\"Checks rpm output for the updated package\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote CentOS host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"An updated fetchmail package that fixes multiple security issues is\nnow available for Red Hat Enterprise Linux 3, 4, and 5.\n\nThis update has been rated as having moderate security impact by the\nRed Hat Security Response Team.\n\nFetchmail is a remote mail retrieval and forwarding utility intended\nfor use over on-demand TCP/IP links, such as SLIP and PPP connections.\n\nIt was discovered that fetchmail is affected by the previously\npublished 'null prefix attack', caused by incorrect handling of NULL\ncharacters in X.509 certificates. If an attacker is able to get a\ncarefully-crafted certificate signed by a trusted Certificate\nAuthority, the attacker could use the certificate during a\nman-in-the-middle attack and potentially confuse fetchmail into\naccepting it by mistake. (CVE-2009-2666)\n\nA flaw was found in the way fetchmail handles rejections from a remote\nSMTP server when sending warning mail to the postmaster. If fetchmail\nsent a warning mail to the postmaster of an SMTP server and that SMTP\nserver rejected it, fetchmail could crash. (CVE-2007-4565)\n\nA flaw was found in fetchmail. When fetchmail is run in double verbose\nmode ('-v -v'), it could crash upon receiving certain, malformed mail\nmessages with long headers. A remote attacker could use this flaw to\ncause a denial of service if fetchmail was also running in daemon mode\n('-d'). (CVE-2008-2711)\n\nNote: when using SSL-enabled services, it is recommended that the\nfetchmail '--sslcertck' option be used to enforce strict SSL\ncertificate checking.\n\nAll fetchmail users should upgrade to this updated package, which\ncontains backported patches to correct these issues. If fetchmail is\nrunning in daemon mode, it must be restarted for this update to take\neffect (use the 'fetchmail --quit' command to stop the fetchmail\nprocess).\"\n );\n # https://lists.centos.org/pipermail/centos-announce/2009-October/016226.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?c76bd2ba\"\n );\n # https://lists.centos.org/pipermail/centos-announce/2009-October/016227.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?dab1eea8\"\n );\n # https://lists.centos.org/pipermail/centos-announce/2009-September/016125.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?fa4c5b68\"\n );\n # https://lists.centos.org/pipermail/centos-announce/2009-September/016126.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?f28a6314\"\n );\n # https://lists.centos.org/pipermail/centos-announce/2009-September/016127.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?36403cf8\"\n );\n # https://lists.centos.org/pipermail/centos-announce/2009-September/016128.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?c8dcf387\"\n );\n # https://lists.centos.org/pipermail/centos-announce/2009-September/016159.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?10766e6a\"\n );\n # https://lists.centos.org/pipermail/centos-announce/2009-September/016160.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?9ab64493\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected fetchmail package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n script_cwe_id(20, 310);\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:fetchmail\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:centos:centos:3\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:centos:centos:4\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:centos:centos:5\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2007/08/27\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2009/10/30\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2009/09/09\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2009-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"CentOS Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/CentOS/release\", \"Host/CentOS/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/CentOS/release\");\nif (isnull(release) || \"CentOS\" >!< release) audit(AUDIT_OS_NOT, \"CentOS\");\nos_ver = pregmatch(pattern: \"CentOS(?: Linux)? release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"CentOS\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^(3|4|5)([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"CentOS 3.x / 4.x / 5.x\", \"CentOS \" + os_ver);\n\nif (!get_kb_item(\"Host/CentOS/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && \"ia64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"CentOS\", cpu);\n\n\nflag = 0;\nif (rpm_check(release:\"CentOS-3\", cpu:\"i386\", reference:\"fetchmail-6.2.0-3.el3.5\")) flag++;\nif (rpm_check(release:\"CentOS-3\", cpu:\"x86_64\", reference:\"fetchmail-6.2.0-3.el3.5\")) flag++;\n\nif (rpm_check(release:\"CentOS-4\", cpu:\"i386\", reference:\"fetchmail-6.2.5-6.0.1.el4_8.1\")) flag++;\nif (rpm_check(release:\"CentOS-4\", cpu:\"x86_64\", reference:\"fetchmail-6.2.5-6.0.1.el4_8.1\")) flag++;\n\nif (rpm_check(release:\"CentOS-5\", reference:\"fetchmail-6.3.6-1.1.el5_3.1\")) flag++;\n\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"fetchmail\");\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-05-18T14:26:26", "description": "An updated fetchmail package that fixes multiple security issues is now available for Red Hat Enterprise Linux 3, 4, and 5.\n\nThis update has been rated as having moderate security impact by the Red Hat Security Response Team.\n\nFetchmail is a remote mail retrieval and forwarding utility intended for use over on-demand TCP/IP links, such as SLIP and PPP connections.\n\nIt was discovered that fetchmail is affected by the previously published 'null prefix attack', caused by incorrect handling of NULL characters in X.509 certificates. If an attacker is able to get a carefully-crafted certificate signed by a trusted Certificate Authority, the attacker could use the certificate during a man-in-the-middle attack and potentially confuse fetchmail into accepting it by mistake. (CVE-2009-2666)\n\nA flaw was found in the way fetchmail handles rejections from a remote SMTP server when sending warning mail to the postmaster. If fetchmail sent a warning mail to the postmaster of an SMTP server and that SMTP server rejected it, fetchmail could crash. (CVE-2007-4565)\n\nA flaw was found in fetchmail. When fetchmail is run in double verbose mode ('-v -v'), it could crash upon receiving certain, malformed mail messages with long headers. A remote attacker could use this flaw to cause a denial of service if fetchmail was also running in daemon mode ('-d'). (CVE-2008-2711)\n\nNote: when using SSL-enabled services, it is recommended that the fetchmail '--sslcertck' option be used to enforce strict SSL certificate checking.\n\nAll fetchmail users should upgrade to this updated package, which contains backported patches to correct these issues. If fetchmail is running in daemon mode, it must be restarted for this update to take effect (use the 'fetchmail --quit' command to stop the fetchmail process).", "cvss3": {}, "published": "2009-09-09T00:00:00", "type": "nessus", "title": "RHEL 3 / 4 / 5 : fetchmail (RHSA-2009:1427)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2007-4565", "CVE-2008-2711", "CVE-2009-2666"], "modified": "2021-01-14T00:00:00", "cpe": ["p-cpe:/a:redhat:enterprise_linux:fetchmail", "cpe:/o:redhat:enterprise_linux:3", "cpe:/o:redhat:enterprise_linux:4", "cpe:/o:redhat:enterprise_linux:4.8", "cpe:/o:redhat:enterprise_linux:5", "cpe:/o:redhat:enterprise_linux:5.4"], "id": "REDHAT-RHSA-2009-1427.NASL", "href": "https://www.tenable.com/plugins/nessus/40901", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Red Hat Security Advisory RHSA-2009:1427. The text \n# itself is copyright (C) Red Hat, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(40901);\n script_version(\"1.25\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/14\");\n\n script_cve_id(\"CVE-2007-4565\", \"CVE-2008-2711\", \"CVE-2009-2666\");\n script_bugtraq_id(25495, 29705);\n script_xref(name:\"RHSA\", value:\"2009:1427\");\n\n script_name(english:\"RHEL 3 / 4 / 5 : fetchmail (RHSA-2009:1427)\");\n script_summary(english:\"Checks the rpm output for the updated package\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Red Hat host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"An updated fetchmail package that fixes multiple security issues is\nnow available for Red Hat Enterprise Linux 3, 4, and 5.\n\nThis update has been rated as having moderate security impact by the\nRed Hat Security Response Team.\n\nFetchmail is a remote mail retrieval and forwarding utility intended\nfor use over on-demand TCP/IP links, such as SLIP and PPP connections.\n\nIt was discovered that fetchmail is affected by the previously\npublished 'null prefix attack', caused by incorrect handling of NULL\ncharacters in X.509 certificates. If an attacker is able to get a\ncarefully-crafted certificate signed by a trusted Certificate\nAuthority, the attacker could use the certificate during a\nman-in-the-middle attack and potentially confuse fetchmail into\naccepting it by mistake. (CVE-2009-2666)\n\nA flaw was found in the way fetchmail handles rejections from a remote\nSMTP server when sending warning mail to the postmaster. If fetchmail\nsent a warning mail to the postmaster of an SMTP server and that SMTP\nserver rejected it, fetchmail could crash. (CVE-2007-4565)\n\nA flaw was found in fetchmail. When fetchmail is run in double verbose\nmode ('-v -v'), it could crash upon receiving certain, malformed mail\nmessages with long headers. A remote attacker could use this flaw to\ncause a denial of service if fetchmail was also running in daemon mode\n('-d'). (CVE-2008-2711)\n\nNote: when using SSL-enabled services, it is recommended that the\nfetchmail '--sslcertck' option be used to enforce strict SSL\ncertificate checking.\n\nAll fetchmail users should upgrade to this updated package, which\ncontains backported patches to correct these issues. If fetchmail is\nrunning in daemon mode, it must be restarted for this update to take\neffect (use the 'fetchmail --quit' command to stop the fetchmail\nprocess).\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2007-4565\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2008-2711\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2009-2666\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/errata/RHSA-2009:1427\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected fetchmail package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n script_cwe_id(20, 310);\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:fetchmail\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:3\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:4\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:4.8\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:5\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:5.4\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2007/08/27\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2009/09/08\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2009/09/09\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2009-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Red Hat Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"misc_func.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Red Hat\" >!< release) audit(AUDIT_OS_NOT, \"Red Hat\");\nos_ver = pregmatch(pattern: \"Red Hat Enterprise Linux.*release ([0-9]+(\\.[0-9]+)?)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Red Hat\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^(3|4|5)([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Red Hat 3.x / 4.x / 5.x\", \"Red Hat \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\" && \"s390\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Red Hat\", cpu);\n\nyum_updateinfo = get_kb_item(\"Host/RedHat/yum-updateinfo\");\nif (!empty_or_null(yum_updateinfo)) \n{\n rhsa = \"RHSA-2009:1427\";\n yum_report = redhat_generate_yum_updateinfo_report(rhsa:rhsa);\n if (!empty_or_null(yum_report))\n {\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : yum_report \n );\n exit(0);\n }\n else\n {\n audit_message = \"affected by Red Hat security advisory \" + rhsa;\n audit(AUDIT_OS_NOT, audit_message);\n }\n}\nelse\n{\n flag = 0;\n if (rpm_check(release:\"RHEL3\", reference:\"fetchmail-6.2.0-3.el3.5\")) flag++;\n\n\n if (rpm_check(release:\"RHEL4\", reference:\"fetchmail-6.2.5-6.0.1.el4_8.1\")) flag++;\n\n\n if (rpm_check(release:\"RHEL5\", cpu:\"i386\", reference:\"fetchmail-6.3.6-1.1.el5_3.1\")) flag++;\n\n if (rpm_check(release:\"RHEL5\", cpu:\"s390x\", reference:\"fetchmail-6.3.6-1.1.el5_3.1\")) flag++;\n\n if (rpm_check(release:\"RHEL5\", cpu:\"x86_64\", reference:\"fetchmail-6.3.6-1.1.el5_3.1\")) flag++;\n\n\n if (flag)\n {\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get() + redhat_report_package_caveat()\n );\n exit(0);\n }\n else\n {\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"fetchmail\");\n }\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-05-18T14:27:16", "description": "CVE-2007-4565 Fetchmail NULL pointer dereference\n\nCVE-2008-2711 fetchmail: Crash in large log messages in verbose mode\n\nCVE-2009-2666 fetchmail: SSL null terminator bypass\n\nIt was discovered that fetchmail is affected by the previously published 'null prefix attack', caused by incorrect handling of NULL characters in X.509 certificates. If an attacker is able to get a carefully-crafted certificate signed by a trusted Certificate Authority, the attacker could use the certificate during a man-in-the-middle attack and potentially confuse fetchmail into accepting it by mistake. (CVE-2009-2666)\n\nA flaw was found in the way fetchmail handles rejections from a remote SMTP server when sending warning mail to the postmaster. If fetchmail sent a warning mail to the postmaster of an SMTP server and that SMTP server rejected it, fetchmail could crash. (CVE-2007-4565)\n\nA flaw was found in fetchmail. When fetchmail is run in double verbose mode ('-v -v'), it could crash upon receiving certain, malformed mail messages with long headers. A remote attacker could use this flaw to cause a denial of service if fetchmail was also running in daemon mode ('-d'). (CVE-2008-2711)\n\nIf fetchmail is running in daemon mode, it must be restarted for this update to take effect (use the 'fetchmail --quit' command to stop the fetchmail process).", "cvss3": {}, "published": "2012-08-01T00:00:00", "type": "nessus", "title": "Scientific Linux Security Update : fetchmail on SL3.x, SL4.x, SL5.x i386/x86_64", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2007-4565", "CVE-2008-2711", "CVE-2009-2666"], "modified": "2021-01-14T00:00:00", "cpe": ["x-cpe:/o:fermilab:scientific_linux"], "id": "SL_20090908_FETCHMAIL_ON_SL3_X.NASL", "href": "https://www.tenable.com/plugins/nessus/60662", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text is (C) Scientific Linux.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(60662);\n script_version(\"1.6\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/14\");\n\n script_cve_id(\"CVE-2007-4565\", \"CVE-2008-2711\", \"CVE-2009-2666\");\n\n script_name(english:\"Scientific Linux Security Update : fetchmail on SL3.x, SL4.x, SL5.x i386/x86_64\");\n script_summary(english:\"Checks rpm output for the updated package\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Scientific Linux host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"CVE-2007-4565 Fetchmail NULL pointer dereference\n\nCVE-2008-2711 fetchmail: Crash in large log messages in verbose mode\n\nCVE-2009-2666 fetchmail: SSL null terminator bypass\n\nIt was discovered that fetchmail is affected by the previously\npublished 'null prefix attack', caused by incorrect handling of NULL\ncharacters in X.509 certificates. If an attacker is able to get a\ncarefully-crafted certificate signed by a trusted Certificate\nAuthority, the attacker could use the certificate during a\nman-in-the-middle attack and potentially confuse fetchmail into\naccepting it by mistake. (CVE-2009-2666)\n\nA flaw was found in the way fetchmail handles rejections from a remote\nSMTP server when sending warning mail to the postmaster. If fetchmail\nsent a warning mail to the postmaster of an SMTP server and that SMTP\nserver rejected it, fetchmail could crash. (CVE-2007-4565)\n\nA flaw was found in fetchmail. When fetchmail is run in double verbose\nmode ('-v -v'), it could crash upon receiving certain, malformed mail\nmessages with long headers. A remote attacker could use this flaw to\ncause a denial of service if fetchmail was also running in daemon mode\n('-d'). (CVE-2008-2711)\n\nIf fetchmail is running in daemon mode, it must be restarted for this\nupdate to take effect (use the 'fetchmail --quit' command to stop the\nfetchmail process).\"\n );\n # https://listserv.fnal.gov/scripts/wa.exe?A2=ind0909&L=scientific-linux-errata&T=0&P=329\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?40f1306b\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected fetchmail package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N\");\n script_cwe_id(20, 310);\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"x-cpe:/o:fermilab:scientific_linux\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2009/09/08\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2012/08/01\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2012-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Scientific Linux Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Scientific Linux \" >!< release) audit(AUDIT_HOST_NOT, \"running Scientific Linux\");\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (cpu >!< \"x86_64\" && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Scientific Linux\", cpu);\n\n\nflag = 0;\nif (rpm_check(release:\"SL3\", reference:\"fetchmail-6.2.0-3.el3.5\")) flag++;\n\nif (rpm_check(release:\"SL4\", reference:\"fetchmail-6.2.5-6.0.1.el4_8.1\")) flag++;\n\nif (rpm_check(release:\"SL5\", reference:\"fetchmail-6.3.6-1.1.el5_3.1\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-05-18T15:39:40", "description": "From Red Hat Security Advisory 2009:1427 :\n\nAn updated fetchmail package that fixes multiple security issues is now available for Red Hat Enterprise Linux 3, 4, and 5.\n\nThis update has been rated as having moderate security impact by the Red Hat Security Response Team.\n\nFetchmail is a remote mail retrieval and forwarding utility intended for use over on-demand TCP/IP links, such as SLIP and PPP connections.\n\nIt was discovered that fetchmail is affected by the previously published 'null prefix attack', caused by incorrect handling of NULL characters in X.509 certificates. If an attacker is able to get a carefully-crafted certificate signed by a trusted Certificate Authority, the attacker could use the certificate during a man-in-the-middle attack and potentially confuse fetchmail into accepting it by mistake. (CVE-2009-2666)\n\nA flaw was found in the way fetchmail handles rejections from a remote SMTP server when sending warning mail to the postmaster. If fetchmail sent a warning mail to the postmaster of an SMTP server and that SMTP server rejected it, fetchmail could crash. (CVE-2007-4565)\n\nA flaw was found in fetchmail. When fetchmail is run in double verbose mode ('-v -v'), it could crash upon receiving certain, malformed mail messages with long headers. A remote attacker could use this flaw to cause a denial of service if fetchmail was also running in daemon mode ('-d'). (CVE-2008-2711)\n\nNote: when using SSL-enabled services, it is recommended that the fetchmail '--sslcertck' option be used to enforce strict SSL certificate checking.\n\nAll fetchmail users should upgrade to this updated package, which contains backported patches to correct these issues. If fetchmail is running in daemon mode, it must be restarted for this update to take effect (use the 'fetchmail --quit' command to stop the fetchmail process).", "cvss3": {}, "published": "2013-07-12T00:00:00", "type": "nessus", "title": "Oracle Linux 3 / 4 / 5 : fetchmail (ELSA-2009-1427)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2007-4565", "CVE-2008-2711", "CVE-2009-2666"], "modified": "2021-01-14T00:00:00", "cpe": ["p-cpe:/a:oracle:linux:fetchmail", "cpe:/o:oracle:linux:3", "cpe:/o:oracle:linux:4", "cpe:/o:oracle:linux:5"], "id": "ORACLELINUX_ELSA-2009-1427.NASL", "href": "https://www.tenable.com/plugins/nessus/67920", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Red Hat Security Advisory RHSA-2009:1427 and \n# Oracle Linux Security Advisory ELSA-2009-1427 respectively.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(67920);\n script_version(\"1.11\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/14\");\n\n script_cve_id(\"CVE-2007-4565\", \"CVE-2008-2711\", \"CVE-2009-2666\");\n script_bugtraq_id(25495, 29705);\n script_xref(name:\"RHSA\", value:\"2009:1427\");\n\n script_name(english:\"Oracle Linux 3 / 4 / 5 : fetchmail (ELSA-2009-1427)\");\n script_summary(english:\"Checks rpm output for the updated package\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Oracle Linux host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"From Red Hat Security Advisory 2009:1427 :\n\nAn updated fetchmail package that fixes multiple security issues is\nnow available for Red Hat Enterprise Linux 3, 4, and 5.\n\nThis update has been rated as having moderate security impact by the\nRed Hat Security Response Team.\n\nFetchmail is a remote mail retrieval and forwarding utility intended\nfor use over on-demand TCP/IP links, such as SLIP and PPP connections.\n\nIt was discovered that fetchmail is affected by the previously\npublished 'null prefix attack', caused by incorrect handling of NULL\ncharacters in X.509 certificates. If an attacker is able to get a\ncarefully-crafted certificate signed by a trusted Certificate\nAuthority, the attacker could use the certificate during a\nman-in-the-middle attack and potentially confuse fetchmail into\naccepting it by mistake. (CVE-2009-2666)\n\nA flaw was found in the way fetchmail handles rejections from a remote\nSMTP server when sending warning mail to the postmaster. If fetchmail\nsent a warning mail to the postmaster of an SMTP server and that SMTP\nserver rejected it, fetchmail could crash. (CVE-2007-4565)\n\nA flaw was found in fetchmail. When fetchmail is run in double verbose\nmode ('-v -v'), it could crash upon receiving certain, malformed mail\nmessages with long headers. A remote attacker could use this flaw to\ncause a denial of service if fetchmail was also running in daemon mode\n('-d'). (CVE-2008-2711)\n\nNote: when using SSL-enabled services, it is recommended that the\nfetchmail '--sslcertck' option be used to enforce strict SSL\ncertificate checking.\n\nAll fetchmail users should upgrade to this updated package, which\ncontains backported patches to correct these issues. If fetchmail is\nrunning in daemon mode, it must be restarted for this update to take\neffect (use the 'fetchmail --quit' command to stop the fetchmail\nprocess).\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://oss.oracle.com/pipermail/el-errata/2009-September/001137.html\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://oss.oracle.com/pipermail/el-errata/2009-September/001139.html\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://oss.oracle.com/pipermail/el-errata/2009-September/001143.html\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected fetchmail package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n script_cwe_id(20, 310);\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:oracle:linux:fetchmail\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:oracle:linux:3\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:oracle:linux:4\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:oracle:linux:5\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2007/08/27\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2009/09/10\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2013/07/12\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2013-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Oracle Linux Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/OracleLinux\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/OracleLinux\")) audit(AUDIT_OS_NOT, \"Oracle Linux\");\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || !pregmatch(pattern: \"Oracle (?:Linux Server|Enterprise Linux)\", string:release)) audit(AUDIT_OS_NOT, \"Oracle Linux\");\nos_ver = pregmatch(pattern: \"Oracle (?:Linux Server|Enterprise Linux) .*release ([0-9]+(\\.[0-9]+)?)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Oracle Linux\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^(3|4|5)([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Oracle Linux 3 / 4 / 5\", \"Oracle Linux \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && \"ia64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Oracle Linux\", cpu);\n\nflag = 0;\nif (rpm_check(release:\"EL3\", cpu:\"i386\", reference:\"fetchmail-6.2.0-3.el3.5\")) flag++;\nif (rpm_check(release:\"EL3\", cpu:\"x86_64\", reference:\"fetchmail-6.2.0-3.el3.5\")) flag++;\n\nif (rpm_check(release:\"EL4\", reference:\"fetchmail-6.2.5-6.0.1.el4_8.1\")) flag++;\n\nif (rpm_check(release:\"EL5\", reference:\"fetchmail-6.3.6-1.1.el5_3.1\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"fetchmail\");\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-05-18T14:21:19", "description": "A flaw in fetchmail was discovered that allowed remote attackers to cause a denial of service (crash and persistent mail failure) via a malformed message with long headers. The crash only occured when fetchmail was called in '-v -v' mode (CVE-2008-2711).\n\nThe updated packages have been patched to prevent this issue.", "cvss3": {}, "published": "2009-04-23T00:00:00", "type": "nessus", "title": "Mandriva Linux Security Advisory : fetchmail (MDVSA-2008:117)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2008-2711"], "modified": "2021-01-06T00:00:00", "cpe": ["cpe:/o:mandriva:linux:2008.0", "cpe:/o:mandriva:linux:2008.1", "cpe:/o:mandriva:linux:2007.1", "p-cpe:/a:mandriva:linux:fetchmail", "p-cpe:/a:mandriva:linux:fetchmail-daemon", "p-cpe:/a:mandriva:linux:fetchmailconf"], "id": "MANDRIVA_MDVSA-2008-117.NASL", "href": "https://www.tenable.com/plugins/nessus/36958", "sourceData": "#%NASL_MIN_LEVEL 70300\n\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Mandriva Linux Security Advisory MDVSA-2008:117. \n# The text itself is copyright (C) Mandriva S.A.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(36958);\n script_version(\"1.15\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/06\");\n\n script_cve_id(\"CVE-2008-2711\");\n script_bugtraq_id(29705);\n script_xref(name:\"MDVSA\", value:\"2008:117\");\n\n script_name(english:\"Mandriva Linux Security Advisory : fetchmail (MDVSA-2008:117)\");\n script_summary(english:\"Checks rpm output for the updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\n\"The remote Mandriva Linux host is missing one or more security\nupdates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"A flaw in fetchmail was discovered that allowed remote attackers to\ncause a denial of service (crash and persistent mail failure) via a\nmalformed message with long headers. The crash only occured when\nfetchmail was called in '-v -v' mode (CVE-2008-2711).\n\nThe updated packages have been patched to prevent this issue.\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"Update the affected fetchmail, fetchmail-daemon and / or fetchmailconf\npackages.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n script_cwe_id(20);\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:fetchmail\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:fetchmail-daemon\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:fetchmailconf\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:mandriva:linux:2007.1\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:mandriva:linux:2008.0\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:mandriva:linux:2008.1\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2008/06/19\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2009/04/23\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2009-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Mandriva Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/Mandrake/release\", \"Host/Mandrake/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Mandrake/release\")) audit(AUDIT_OS_NOT, \"Mandriva / Mandake Linux\");\nif (!get_kb_item(\"Host/Mandrake/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (cpu !~ \"^(amd64|i[3-6]86|x86_64)$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Mandriva / Mandrake Linux\", cpu);\n\n\nflag = 0;\nif (rpm_check(release:\"MDK2007.1\", reference:\"fetchmail-6.3.6-1.3mdv2007.1\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2007.1\", reference:\"fetchmail-daemon-6.3.6-1.3mdv2007.1\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2007.1\", reference:\"fetchmailconf-6.3.6-1.3mdv2007.1\", yank:\"mdv\")) flag++;\n\nif (rpm_check(release:\"MDK2008.0\", reference:\"fetchmail-6.3.8-4.1mdv2008.0\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2008.0\", reference:\"fetchmail-daemon-6.3.8-4.1mdv2008.0\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2008.0\", reference:\"fetchmailconf-6.3.8-4.1mdv2008.0\", yank:\"mdv\")) flag++;\n\nif (rpm_check(release:\"MDK2008.1\", reference:\"fetchmail-6.3.8-7.1mdv2008.1\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2008.1\", reference:\"fetchmail-daemon-6.3.8-7.1mdv2008.1\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2008.1\", reference:\"fetchmailconf-6.3.8-7.1mdv2008.1\", yank:\"mdv\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-05-18T14:45:24", "description": "http://fetchmail.berlios.de/fetchmail-SA-2008-01.txt\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {}, "published": "2008-07-02T00:00:00", "type": "nessus", "title": "Fedora 8 : fetchmail-6.3.8-4.fc8 (2008-5800)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2008-2711"], "modified": "2021-01-11T00:00:00", "cpe": ["p-cpe:/a:fedoraproject:fedora:fetchmail", "cpe:/o:fedoraproject:fedora:8"], "id": "FEDORA_2008-5800.NASL", "href": "https://www.tenable.com/plugins/nessus/33373", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory 2008-5800.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(33373);\n script_version(\"1.16\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/11\");\n\n script_cve_id(\"CVE-2008-2711\");\n script_bugtraq_id(29705);\n script_xref(name:\"FEDORA\", value:\"2008-5800\");\n\n script_name(english:\"Fedora 8 : fetchmail-6.3.8-4.fc8 (2008-5800)\");\n script_summary(english:\"Checks rpm output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"http://fetchmail.berlios.de/fetchmail-SA-2008-01.txt\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://fetchmail.berlios.de/fetchmail-SA-2008-01.txt\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=451758\"\n );\n # https://lists.fedoraproject.org/pipermail/package-announce/2008-June/011838.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?c1e6f5c9\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected fetchmail package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n script_cwe_id(20);\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:fetchmail\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:8\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2008/06/28\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2008/07/02\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2008-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = eregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! ereg(pattern:\"^8([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 8.x\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\nflag = 0;\nif (rpm_check(release:\"FC8\", reference:\"fetchmail-6.3.8-4.fc8\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"fetchmail\");\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-05-18T14:45:18", "description": "Matthias Andree reports :\n\n2008-06-24 1.2 also fixed issue in report_complete (reported by Petr Uzel)", "cvss3": {}, "published": "2008-07-02T00:00:00", "type": "nessus", "title": "FreeBSD : fetchmail -- potential crash in -v -v verbose mode (revised patch) (1e8e63c0-478a-11dd-a88d-000ea69a5213)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2008-2711"], "modified": "2021-01-06T00:00:00", "cpe": ["p-cpe:/a:freebsd:freebsd:fetchmail", "cpe:/o:freebsd:freebsd"], "id": "FREEBSD_PKG_1E8E63C0478A11DDA88D000EA69A5213.NASL", "href": "https://www.tenable.com/plugins/nessus/33374", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from the FreeBSD VuXML database :\n#\n# Copyright 2003-2018 Jacques Vidrine and contributors\n#\n# Redistribution and use in source (VuXML) and 'compiled' forms (SGML,\n# HTML, PDF, PostScript, RTF and so forth) with or without modification,\n# are permitted provided that the following conditions are met:\n# 1. Redistributions of source code (VuXML) must retain the above\n# copyright notice, this list of conditions and the following\n# disclaimer as the first lines of this file unmodified.\n# 2. Redistributions in compiled form (transformed to other DTDs,\n# published online in any format, converted to PDF, PostScript,\n# RTF and other formats) must reproduce the above copyright\n# notice, this list of conditions and the following disclaimer\n# in the documentation and/or other materials provided with the\n# distribution.\n# \n# THIS DOCUMENTATION IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS \"AS IS\"\n# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,\n# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR\n# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS\n# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,\n# OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT\n# OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR\n# BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,\n# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE\n# OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS DOCUMENTATION,\n# EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(33374);\n script_version(\"1.14\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/06\");\n\n script_cve_id(\"CVE-2008-2711\");\n\n script_name(english:\"FreeBSD : fetchmail -- potential crash in -v -v verbose mode (revised patch) (1e8e63c0-478a-11dd-a88d-000ea69a5213)\");\n script_summary(english:\"Checks for updated package in pkg_info output\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote FreeBSD host is missing a security-related update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Matthias Andree reports :\n\n2008-06-24 1.2 also fixed issue in report_complete (reported by Petr\nUzel)\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.fetchmail.info/fetchmail-SA-2008-01.txt\"\n );\n # https://vuxml.freebsd.org/freebsd/1e8e63c0-478a-11dd-a88d-000ea69a5213.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?b9aef85e\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected package.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P\");\n script_cwe_id(20);\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:freebsd:freebsd:fetchmail\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:freebsd:freebsd\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2008/06/24\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2008/07/01\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2008/07/02\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2008-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"FreeBSD Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/FreeBSD/release\", \"Host/FreeBSD/pkg_info\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"freebsd_package.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/FreeBSD/release\")) audit(AUDIT_OS_NOT, \"FreeBSD\");\nif (!get_kb_item(\"Host/FreeBSD/pkg_info\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\n\nif (pkg_test(save_report:TRUE, pkg:\"fetchmail<6.3.8_7\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:pkg_report_get());\n else security_warning(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-05-18T14:45:15", "description": "New fetchmail packages are available for Slackware 8.1, 9.0, 9.1, 10.0, 10.1, 10.2, 11.0, 12.0, 12.1, and -current to fix security issues.", "cvss3": {}, "published": "2008-07-29T00:00:00", "type": "nessus", "title": "Slackware 10.0 / 10.1 / 10.2 / 11.0 / 12.0 / 12.1 / 8.1 / 9.0 / 9.1 / current : fetchmail (SSA:2008-210-01)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2008-2711"], "modified": "2021-01-14T00:00:00", "cpe": ["p-cpe:/a:slackware:slackware_linux:fetchmail", "cpe:/o:slackware:slackware_linux", "cpe:/o:slackware:slackware_linux:10.0", "cpe:/o:slackware:slackware_linux:10.1", "cpe:/o:slackware:slackware_linux:10.2", "cpe:/o:slackware:slackware_linux:11.0", "cpe:/o:slackware:slackware_linux:12.0", "cpe:/o:slackware:slackware_linux:12.1", "cpe:/o:slackware:slackware_linux:8.1", "cpe:/o:slackware:slackware_linux:9.0", "cpe:/o:slackware:slackware_linux:9.1"], "id": "SLACKWARE_SSA_2008-210-01.NASL", "href": "https://www.tenable.com/plugins/nessus/33746", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Slackware Security Advisory 2008-210-01. The text \n# itself is copyright (C) Slackware Linux, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(33746);\n script_version(\"1.16\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/14\");\n\n script_cve_id(\"CVE-2008-2711\");\n script_bugtraq_id(29705);\n script_xref(name:\"SSA\", value:\"2008-210-01\");\n\n script_name(english:\"Slackware 10.0 / 10.1 / 10.2 / 11.0 / 12.0 / 12.1 / 8.1 / 9.0 / 9.1 / current : fetchmail (SSA:2008-210-01)\");\n script_summary(english:\"Checks for updated package in /var/log/packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Slackware host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"New fetchmail packages are available for Slackware 8.1, 9.0, 9.1,\n10.0, 10.1, 10.2, 11.0, 12.0, 12.1, and -current to fix security\nissues.\"\n );\n # http://www.slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.495740\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?95e30f29\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected fetchmail package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n script_cwe_id(20);\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:slackware:slackware_linux:fetchmail\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:slackware:slackware_linux\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:slackware:slackware_linux:10.0\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:slackware:slackware_linux:10.1\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:slackware:slackware_linux:10.2\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:slackware:slackware_linux:11.0\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:slackware:slackware_linux:12.0\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:slackware:slackware_linux:12.1\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:slackware:slackware_linux:8.1\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:slackware:slackware_linux:9.0\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:slackware:slackware_linux:9.1\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2008/07/29\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2008/07/29\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2008-2021 Tenable Network Security, Inc.\");\n script_family(english:\"Slackware Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Slackware/release\", \"Host/Slackware/packages\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"slackware.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Slackware/release\")) audit(AUDIT_OS_NOT, \"Slackware\");\nif (!get_kb_item(\"Host/Slackware/packages\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Slackware\", cpu);\n\n\nflag = 0;\nif (slackware_check(osver:\"8.1\", pkgname:\"fetchmail\", pkgver:\"6.3.8\", pkgarch:\"i386\", pkgnum:\"1_slack8.1\")) flag++;\n\nif (slackware_check(osver:\"9.0\", pkgname:\"fetchmail\", pkgver:\"6.3.8\", pkgarch:\"i386\", pkgnum:\"1_slack9.0\")) flag++;\n\nif (slackware_check(osver:\"9.1\", pkgname:\"fetchmail\", pkgver:\"6.3.8\", pkgarch:\"i486\", pkgnum:\"1_slack9.1\")) flag++;\n\nif (slackware_check(osver:\"10.0\", pkgname:\"fetchmail\", pkgver:\"6.3.8\", pkgarch:\"i486\", pkgnum:\"1_slack10.0\")) flag++;\n\nif (slackware_check(osver:\"10.1\", pkgname:\"fetchmail\", pkgver:\"6.3.8\", pkgarch:\"i486\", pkgnum:\"1_slack10.1\")) flag++;\n\nif (slackware_check(osver:\"10.2\", pkgname:\"fetchmail\", pkgver:\"6.3.8\", pkgarch:\"i486\", pkgnum:\"1_slack10.2\")) flag++;\n\nif (slackware_check(osver:\"11.0\", pkgname:\"fetchmail\", pkgver:\"6.3.8\", pkgarch:\"i486\", pkgnum:\"1_slack11.0\")) flag++;\n\nif (slackware_check(osver:\"12.0\", pkgname:\"fetchmail\", pkgver:\"6.3.8\", pkgarch:\"i486\", pkgnum:\"3_slack12.0\")) flag++;\n\nif (slackware_check(osver:\"12.1\", pkgname:\"fetchmail\", pkgver:\"6.3.8\", pkgarch:\"i486\", pkgnum:\"3_slack12.1\")) flag++;\n\nif (slackware_check(osver:\"current\", pkgname:\"fetchmail\", pkgver:\"6.3.8\", pkgarch:\"i486\", pkgnum:\"3\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:slackware_report_get());\n else security_warning(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-05-18T14:45:03", "description": "http://fetchmail.berlios.de/fetchmail-SA-2008-01.txt\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {}, "published": "2008-07-02T00:00:00", "type": "nessus", "title": "Fedora 9 : fetchmail-6.3.8-7.fc9 (2008-5789)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2008-2711"], "modified": "2021-01-11T00:00:00", "cpe": ["p-cpe:/a:fedoraproject:fedora:fetchmail", "cpe:/o:fedoraproject:fedora:9"], "id": "FEDORA_2008-5789.NASL", "href": "https://www.tenable.com/plugins/nessus/33372", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory 2008-5789.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(33372);\n script_version(\"1.16\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/11\");\n\n script_cve_id(\"CVE-2008-2711\");\n script_bugtraq_id(29705);\n script_xref(name:\"FEDORA\", value:\"2008-5789\");\n\n script_name(english:\"Fedora 9 : fetchmail-6.3.8-7.fc9 (2008-5789)\");\n script_summary(english:\"Checks rpm output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"http://fetchmail.berlios.de/fetchmail-SA-2008-01.txt\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://fetchmail.berlios.de/fetchmail-SA-2008-01.txt\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.redhat.com/show_bug.cgi?id=451758\"\n );\n # https://lists.fedoraproject.org/pipermail/package-announce/2008-June/011834.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?48e2085e\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected fetchmail package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n script_cwe_id(20);\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:fetchmail\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:9\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2008/06/28\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2008/07/02\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2008-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = eregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! ereg(pattern:\"^9([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 9.x\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\nflag = 0;\nif (rpm_check(release:\"FC9\", reference:\"fetchmail-6.3.8-7.fc9\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"fetchmail\");\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-05-18T14:44:27", "description": "Matthias Andree reports :\n\nGunter Nau reported fetchmail crashing on some messages; further debugging by Petr Uzel and Petr Cerny at Novell/SUSE Czech Republic dug up that this happened when fetchmail was trying to print, in -v -v verbose level, headers exceeding 2048 bytes. In this situation, fetchmail would resize the buffer and fill in further parts of the message, but forget to reinitialize its va_list typed source pointer, thus reading data from a garbage address found on the stack at addresses above the function arguments the caller passed in; usually that would be the caller's stack frame.", "cvss3": {}, "published": "2008-06-24T00:00:00", "type": "nessus", "title": "FreeBSD : fetchmail -- potential crash in -v -v verbose mode (168190df-3e9a-11dd-87bc-000ea69a5213)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2008-2711"], "modified": "2021-01-06T00:00:00", "cpe": ["p-cpe:/a:freebsd:freebsd:fetchmail", "cpe:/o:freebsd:freebsd"], "id": "FREEBSD_PKG_168190DF3E9A11DD87BC000EA69A5213.NASL", "href": "https://www.tenable.com/plugins/nessus/33239", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from the FreeBSD VuXML database :\n#\n# Copyright 2003-2018 Jacques Vidrine and contributors\n#\n# Redistribution and use in source (VuXML) and 'compiled' forms (SGML,\n# HTML, PDF, PostScript, RTF and so forth) with or without modification,\n# are permitted provided that the following conditions are met:\n# 1. Redistributions of source code (VuXML) must retain the above\n# copyright notice, this list of conditions and the following\n# disclaimer as the first lines of this file unmodified.\n# 2. Redistributions in compiled form (transformed to other DTDs,\n# published online in any format, converted to PDF, PostScript,\n# RTF and other formats) must reproduce the above copyright\n# notice, this list of conditions and the following disclaimer\n# in the documentation and/or other materials provided with the\n# distribution.\n# \n# THIS DOCUMENTATION IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS \"AS IS\"\n# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,\n# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR\n# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS\n# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,\n# OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT\n# OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR\n# BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,\n# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE\n# OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS DOCUMENTATION,\n# EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(33239);\n script_version(\"1.14\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/06\");\n\n script_cve_id(\"CVE-2008-2711\");\n\n script_name(english:\"FreeBSD : fetchmail -- potential crash in -v -v verbose mode (168190df-3e9a-11dd-87bc-000ea69a5213)\");\n script_summary(english:\"Checks for updated package in pkg_info output\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote FreeBSD host is missing a security-related update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Matthias Andree reports :\n\nGunter Nau reported fetchmail crashing on some messages; further\ndebugging by Petr Uzel and Petr Cerny at Novell/SUSE Czech Republic\ndug up that this happened when fetchmail was trying to print, in -v -v\nverbose level, headers exceeding 2048 bytes. In this situation,\nfetchmail would resize the buffer and fill in further parts of the\nmessage, but forget to reinitialize its va_list typed source pointer,\nthus reading data from a garbage address found on the stack at\naddresses above the function arguments the caller passed in; usually\nthat would be the caller's stack frame.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.fetchmail.info/fetchmail-SA-2008-01.txt\"\n );\n # https://vuxml.freebsd.org/freebsd/168190df-3e9a-11dd-87bc-000ea69a5213.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?ecf4b84b\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected package.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P\");\n script_cwe_id(20);\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:freebsd:freebsd:fetchmail\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:freebsd:freebsd\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2008/06/13\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2008/06/20\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2008/06/24\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2008-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"FreeBSD Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/FreeBSD/release\", \"Host/FreeBSD/pkg_info\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"freebsd_package.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/FreeBSD/release\")) audit(AUDIT_OS_NOT, \"FreeBSD\");\nif (!get_kb_item(\"Host/FreeBSD/pkg_info\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\n\nif (pkg_test(save_report:TRUE, pkg:\"fetchmail<6.3.8_6\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:pkg_report_get());\n else security_warning(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2022-03-27T14:26:56", "description": "- Mon Sep 3 2007 Vitezslav Crhonek <vcrhonek at redhat.com> - 6.3.6-3\n\n - Fix license\n\n - Fix fetchmail NULL pointer dereference (CVE-2007-4565) Resolves: #260881\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {}, "published": "2007-09-05T00:00:00", "type": "nessus", "title": "Fedora Core 6 : fetchmail-6.3.6-3.fc6 (2007-689)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2007-4565"], "modified": "2021-01-11T00:00:00", "cpe": ["p-cpe:/a:fedoraproject:fedora:fetchmail", "p-cpe:/a:fedoraproject:fedora:fetchmail-debuginfo", "cpe:/o:fedoraproject:fedora_core:6"], "id": "FEDORA_2007-689.NASL", "href": "https://www.tenable.com/plugins/nessus/25979", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory 2007-689.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(25979);\n script_version(\"1.14\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/11\");\n\n script_xref(name:\"FEDORA\", value:\"2007-689\");\n\n script_name(english:\"Fedora Core 6 : fetchmail-6.3.6-3.fc6 (2007-689)\");\n script_summary(english:\"Checks rpm output for the updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora Core host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\" - Mon Sep 3 2007 Vitezslav Crhonek <vcrhonek at\n redhat.com> - 6.3.6-3\n\n - Fix license\n\n - Fix fetchmail NULL pointer dereference (CVE-2007-4565)\n Resolves: #260881\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n # https://lists.fedoraproject.org/pipermail/package-announce/2007-September/003624.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?759504ce\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected fetchmail and / or fetchmail-debuginfo packages.\"\n );\n script_set_attribute(attribute:\"risk_factor\", value:\"High\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:fetchmail\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:fetchmail-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora_core:6\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2007/09/04\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2007/09/05\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2007-2021 Tenable Network Security, Inc.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = eregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! ereg(pattern:\"^6([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 6.x\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\nflag = 0;\nif (rpm_check(release:\"FC6\", reference:\"fetchmail-6.3.6-3.fc6\")) flag++;\nif (rpm_check(release:\"FC6\", reference:\"fetchmail-debuginfo-6.3.6-3.fc6\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"fetchmail / fetchmail-debuginfo\");\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-05-18T15:03:35", "description": "This update fixes a remote denial-of-service attack. (CVE-2007-4565)", "cvss3": {}, "published": "2007-12-13T00:00:00", "type": "nessus", "title": "SuSE 10 Security Update : fetchmail (ZYPP Patch Number 4462)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2007-4565"], "modified": "2021-01-14T00:00:00", "cpe": ["cpe:/o:suse:suse_linux"], "id": "SUSE_FETCHMAIL-4462.NASL", "href": "https://www.tenable.com/plugins/nessus/29426", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The text description of this plugin is (C) Novell, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(29426);\n script_version(\"1.16\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/14\");\n\n script_cve_id(\"CVE-2007-4565\");\n\n script_name(english:\"SuSE 10 Security Update : fetchmail (ZYPP Patch Number 4462)\");\n script_summary(english:\"Checks rpm output for the updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote SuSE 10 host is missing a security-related patch.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\"This update fixes a remote denial-of-service attack. (CVE-2007-4565)\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://support.novell.com/security/cve/CVE-2007-4565.html\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Apply ZYPP patch number 4462.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:suse:suse_linux\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2007/10/02\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2007/12/13\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2007-2021 Tenable Network Security, Inc.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) exit(0, \"Local checks are not enabled.\");\nif (!get_kb_item(\"Host/SuSE/release\")) exit(0, \"The host is not running SuSE.\");\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) exit(1, \"Could not obtain the list of installed packages.\");\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) exit(1, \"Failed to determine the architecture type.\");\nif (cpu >!< \"x86_64\" && cpu !~ \"^i[3-6]86$\") exit(1, \"Local checks for SuSE 10 on the '\"+cpu+\"' architecture have not been implemented.\");\n\n\nflag = 0;\nif (rpm_check(release:\"SLED10\", sp:1, reference:\"fetchmail-6.3.2-15.12\")) flag++;\nif (rpm_check(release:\"SLES10\", sp:1, reference:\"fetchmail-6.3.2-15.12\")) flag++;\nif (rpm_check(release:\"SLES10\", sp:1, reference:\"fetchmailconf-6.3.2-15.12\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse exit(0, \"The host is not affected.\");\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-05-18T15:02:20", "description": "- Mon Sep 3 2007 Vitezslav Crhonek <vcrhonek at redhat.com> - 6.3.7-2\n\n - Fix license\n\n - Fix fetchmail NULL pointer dereference (CVE-2007-4565) Resolves: #260861\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {}, "published": "2007-11-06T00:00:00", "type": "nessus", "title": "Fedora 7 : fetchmail-6.3.7-2.fc7 (2007-1983)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2007-4565"], "modified": "2021-01-11T00:00:00", "cpe": ["p-cpe:/a:fedoraproject:fedora:fetchmail", "p-cpe:/a:fedoraproject:fedora:fetchmail-debuginfo", "cpe:/o:fedoraproject:fedora:7"], "id": "FEDORA_2007-1983.NASL", "href": "https://www.tenable.com/plugins/nessus/27742", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory 2007-1983.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(27742);\n script_version(\"1.13\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/11\");\n\n script_cve_id(\"CVE-2007-4565\");\n script_xref(name:\"FEDORA\", value:\"2007-1983\");\n\n script_name(english:\"Fedora 7 : fetchmail-6.3.7-2.fc7 (2007-1983)\");\n script_summary(english:\"Checks rpm output for the updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\" - Mon Sep 3 2007 Vitezslav Crhonek <vcrhonek at\n redhat.com> - 6.3.7-2\n\n - Fix license\n\n - Fix fetchmail NULL pointer dereference (CVE-2007-4565)\n Resolves: #260861\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n # https://lists.fedoraproject.org/pipermail/package-announce/2007-September/003558.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?902e2444\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected fetchmail and / or fetchmail-debuginfo packages.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:fetchmail\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:fetchmail-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:7\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2007/09/04\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2007/11/06\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2007-2021 Tenable Network Security, Inc.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = eregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! ereg(pattern:\"^7([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 7.x\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\nflag = 0;\nif (rpm_check(release:\"FC7\", reference:\"fetchmail-6.3.7-2.fc7\")) flag++;\nif (rpm_check(release:\"FC7\", reference:\"fetchmail-debuginfo-6.3.7-2.fc7\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"fetchmail / fetchmail-debuginfo\");\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-05-18T15:02:03", "description": "This update fixes a remote denial-of-service attack. (CVE-2007-4565)", "cvss3": {}, "published": "2007-10-25T00:00:00", "type": "nessus", "title": "openSUSE 10 Security Update : fetchmail (fetchmail-4490)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2007-4565"], "modified": "2021-01-14T00:00:00", "cpe": ["p-cpe:/a:novell:opensuse:fetchmail", "p-cpe:/a:novell:opensuse:fetchmailconf", "cpe:/o:novell:opensuse:10.1", "cpe:/o:novell:opensuse:10.2", "cpe:/o:novell:opensuse:10.3"], "id": "SUSE_FETCHMAIL-4490.NASL", "href": "https://www.tenable.com/plugins/nessus/27572", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from openSUSE Security Update fetchmail-4490.\n#\n# The text description of this plugin is (C) SUSE LLC.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(27572);\n script_version(\"1.9\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/14\");\n\n script_cve_id(\"CVE-2007-4565\");\n\n script_name(english:\"openSUSE 10 Security Update : fetchmail (fetchmail-4490)\");\n script_summary(english:\"Check for the fetchmail-4490 patch\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote openSUSE host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\"This update fixes a remote denial-of-service attack. (CVE-2007-4565)\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected fetchmail packages.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:fetchmail\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:fetchmailconf\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:opensuse:10.1\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:opensuse:10.2\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:opensuse:10.3\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2007/10/04\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2007/10/25\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2007-2021 Tenable Network Security, Inc.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release =~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"openSUSE\");\nif (release !~ \"^(SUSE10\\.1|SUSE10\\.2|SUSE10\\.3)$\") audit(AUDIT_OS_RELEASE_NOT, \"openSUSE\", \"10.1 / 10.2 / 10.3\", release);\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nourarch = get_kb_item(\"Host/cpu\");\nif (!ourarch) audit(AUDIT_UNKNOWN_ARCH);\nif (ourarch !~ \"^(i586|i686|x86_64)$\") audit(AUDIT_ARCH_NOT, \"i586 / i686 / x86_64\", ourarch);\n\nflag = 0;\n\nif ( rpm_check(release:\"SUSE10.1\", reference:\"fetchmail-6.3.2-15.12\") ) flag++;\nif ( rpm_check(release:\"SUSE10.1\", reference:\"fetchmailconf-6.3.2-15.12\") ) flag++;\nif ( rpm_check(release:\"SUSE10.2\", reference:\"fetchmail-6.3.5-23.4\") ) flag++;\nif ( rpm_check(release:\"SUSE10.2\", reference:\"fetchmailconf-6.3.5-23.4\") ) flag++;\nif ( rpm_check(release:\"SUSE10.3\", reference:\"fetchmail-6.3.8-57.2\") ) flag++;\nif ( rpm_check(release:\"SUSE10.3\", reference:\"fetchmailconf-6.3.8-57.2\") ) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"fetchmail\");\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-05-18T15:00:31", "description": "Matthias Andree discovered that fetchmail, an SSL enabled POP3, APOP and IMAP mail gatherer/forwarder, can under certain circumstances attempt to dereference a NULL pointer and crash.", "cvss3": {}, "published": "2007-09-24T00:00:00", "type": "nessus", "title": "Debian DSA-1377-2 : fetchmail - NULL pointer dereference", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2007-4565"], "modified": "2021-01-04T00:00:00", "cpe": ["p-cpe:/a:debian:debian_linux:fetchmail", "cpe:/o:debian:debian_linux:4.0"], "id": "DEBIAN_DSA-1377.NASL", "href": "https://www.tenable.com/plugins/nessus/26080", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Debian Security Advisory DSA-1377. The text \n# itself is copyright (C) Software in the Public Interest, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(26080);\n script_version(\"1.17\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/04\");\n\n script_cve_id(\"CVE-2007-4565\");\n script_bugtraq_id(25495);\n script_xref(name:\"DSA\", value:\"1377\");\n\n script_name(english:\"Debian DSA-1377-2 : fetchmail - NULL pointer dereference\");\n script_summary(english:\"Checks dpkg output for the updated package\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Debian host is missing a security-related update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Matthias Andree discovered that fetchmail, an SSL enabled POP3, APOP\nand IMAP mail gatherer/forwarder, can under certain circumstances\nattempt to dereference a NULL pointer and crash.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.debian.org/security/2007/dsa-1377\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"Upgrade the fetchmail package.\n\nFor the old stable distribution (sarge), this problem was not present.\n\nFor the stable distribution (etch), this problem has been fixed in\nversion 6.3.6-1etch1.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:fetchmail\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:debian:debian_linux:4.0\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2007/09/21\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2007/09/24\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2007-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Debian Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Debian/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"debian_package.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Debian/release\")) audit(AUDIT_OS_NOT, \"Debian\");\nif (!get_kb_item(\"Host/Debian/dpkg-l\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\nif (deb_check(release:\"4.0\", prefix:\"fetchmail\", reference:\"6.3.6-1etch1\")) flag++;\nif (deb_check(release:\"4.0\", prefix:\"fetchmailconf\", reference:\"6.3.6-1etch1\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:deb_report_get());\n else security_warning(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-05-18T15:00:19", "description": "Matthias Andree reports :\n\nfetchmail will generate warning messages in certain circumstances (for instance, when leaving oversized messages on the server or login to the upstream fails) and send them to the local postmaster or the user running it.\n\nIf this warning message is then refused by the SMTP listener that fetchmail is forwarding the message to, fetchmail crashes and does not collect further messages until it is restarted.", "cvss3": {}, "published": "2007-09-05T00:00:00", "type": "nessus", "title": "FreeBSD : fetchmail -- denial of service on reject of local warning message (45500f74-5947-11dc-87c1-000e2e5785ad)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2007-4565"], "modified": "2021-01-06T00:00:00", "cpe": ["p-cpe:/a:freebsd:freebsd:fetchmail", "cpe:/o:freebsd:freebsd"], "id": "FREEBSD_PKG_45500F74594711DC87C1000E2E5785AD.NASL", "href": "https://www.tenable.com/plugins/nessus/25981", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from the FreeBSD VuXML database :\n#\n# Copyright 2003-2018 Jacques Vidrine and contributors\n#\n# Redistribution and use in source (VuXML) and 'compiled' forms (SGML,\n# HTML, PDF, PostScript, RTF and so forth) with or without modification,\n# are permitted provided that the following conditions are met:\n# 1. Redistributions of source code (VuXML) must retain the above\n# copyright notice, this list of conditions and the following\n# disclaimer as the first lines of this file unmodified.\n# 2. Redistributions in compiled form (transformed to other DTDs,\n# published online in any format, converted to PDF, PostScript,\n# RTF and other formats) must reproduce the above copyright\n# notice, this list of conditions and the following disclaimer\n# in the documentation and/or other materials provided with the\n# distribution.\n# \n# THIS DOCUMENTATION IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS \"AS IS\"\n# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,\n# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR\n# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS\n# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,\n# OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT\n# OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR\n# BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,\n# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE\n# OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS DOCUMENTATION,\n# EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(25981);\n script_version(\"1.12\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/06\");\n\n script_cve_id(\"CVE-2007-4565\");\n\n script_name(english:\"FreeBSD : fetchmail -- denial of service on reject of local warning message (45500f74-5947-11dc-87c1-000e2e5785ad)\");\n script_summary(english:\"Checks for updated package in pkg_info output\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote FreeBSD host is missing a security-related update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Matthias Andree reports :\n\nfetchmail will generate warning messages in certain circumstances (for\ninstance, when leaving oversized messages on the server or login to\nthe upstream fails) and send them to the local postmaster or the user\nrunning it.\n\nIf this warning message is then refused by the SMTP listener that\nfetchmail is forwarding the message to, fetchmail crashes and does not\ncollect further messages until it is restarted.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.fetchmail.info/fetchmail-SA-2007-02.txt\"\n );\n # https://vuxml.freebsd.org/freebsd/45500f74-5947-11dc-87c1-000e2e5785ad.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?ab6e4e30\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected package.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:freebsd:freebsd:fetchmail\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:freebsd:freebsd\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2007/07/29\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2007/09/02\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2007/09/05\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2007-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"FreeBSD Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/FreeBSD/release\", \"Host/FreeBSD/pkg_info\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"freebsd_package.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/FreeBSD/release\")) audit(AUDIT_OS_NOT, \"FreeBSD\");\nif (!get_kb_item(\"Host/FreeBSD/pkg_info\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\n\nif (pkg_test(save_report:TRUE, pkg:\"fetchmail>=4.6.8<6.3.8_4\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:pkg_report_get());\n else security_warning(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-05-18T15:00:20", "description": "A vulnerability in fetchmail was found where it could crash when attempting to deliver an internal warning or error message through an untrusted or compromised SMTP server, leading to a denial of service.\n\nUpdated packages have been patched to prevent these issues.", "cvss3": {}, "published": "2007-09-14T00:00:00", "type": "nessus", "title": "Mandrake Linux Security Advisory : fetchmail (MDKSA-2007:179)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2007-4565"], "modified": "2021-01-06T00:00:00", "cpe": ["p-cpe:/a:mandriva:linux:fetchmail", "p-cpe:/a:mandriva:linux:fetchmail-daemon", "p-cpe:/a:mandriva:linux:fetchmailconf", "cpe:/o:mandriva:linux:2007", "cpe:/o:mandriva:linux:2007.1"], "id": "MANDRAKE_MDKSA-2007-179.NASL", "href": "https://www.tenable.com/plugins/nessus/26046", "sourceData": "#%NASL_MIN_LEVEL 70300\n\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Mandrake Linux Security Advisory MDKSA-2007:179. \n# The text itself is copyright (C) Mandriva S.A.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(26046);\n script_version(\"1.16\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/06\");\n\n script_cve_id(\"CVE-2007-4565\");\n script_xref(name:\"MDKSA\", value:\"2007:179\");\n\n script_name(english:\"Mandrake Linux Security Advisory : fetchmail (MDKSA-2007:179)\");\n script_summary(english:\"Checks rpm output for the updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\n\"The remote Mandrake Linux host is missing one or more security\nupdates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"A vulnerability in fetchmail was found where it could crash when\nattempting to deliver an internal warning or error message through an\nuntrusted or compromised SMTP server, leading to a denial of service.\n\nUpdated packages have been patched to prevent these issues.\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"Update the affected fetchmail, fetchmail-daemon and / or fetchmailconf\npackages.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:fetchmail\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:fetchmail-daemon\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:fetchmailconf\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:mandriva:linux:2007\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:mandriva:linux:2007.1\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2007/09/11\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2007/09/14\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2007-2021 Tenable Network Security, Inc.\");\n script_family(english:\"Mandriva Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/Mandrake/release\", \"Host/Mandrake/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Mandrake/release\")) audit(AUDIT_OS_NOT, \"Mandriva / Mandake Linux\");\nif (!get_kb_item(\"Host/Mandrake/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (cpu !~ \"^(amd64|i[3-6]86|x86_64)$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Mandriva / Mandrake Linux\", cpu);\n\n\nflag = 0;\nif (rpm_check(release:\"MDK2007.0\", reference:\"fetchmail-6.3.4-3.3mdv2007.0\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2007.0\", reference:\"fetchmail-daemon-6.3.4-3.3mdv2007.0\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2007.0\", reference:\"fetchmailconf-6.3.4-3.3mdv2007.0\", yank:\"mdv\")) flag++;\n\nif (rpm_check(release:\"MDK2007.1\", reference:\"fetchmail-6.3.6-1.2mdv2007.1\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2007.1\", reference:\"fetchmail-daemon-6.3.6-1.2mdv2007.1\", yank:\"mdv\")) flag++;\nif (rpm_check(release:\"MDK2007.1\", reference:\"fetchmailconf-6.3.6-1.2mdv2007.1\", yank:\"mdv\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-05-18T14:26:46", "description": "This update fixes a remote denial-of-service attack. (CVE-2007-4565)", "cvss3": {}, "published": "2009-09-24T00:00:00", "type": "nessus", "title": "SuSE9 Security Update : fetchmail (YOU Patch Number 11814)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2007-4565"], "modified": "2021-01-14T00:00:00", "cpe": ["cpe:/o:suse:suse_linux"], "id": "SUSE9_11814.NASL", "href": "https://www.tenable.com/plugins/nessus/41154", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The text description of this plugin is (C) Novell, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(41154);\n script_version(\"1.7\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/14\");\n\n script_cve_id(\"CVE-2007-4565\");\n\n script_name(english:\"SuSE9 Security Update : fetchmail (YOU Patch Number 11814)\");\n script_summary(english:\"Checks rpm output for the updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote SuSE 9 host is missing a security-related patch.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\"This update fixes a remote denial-of-service attack. (CVE-2007-4565)\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://support.novell.com/security/cve/CVE-2007-4565.html\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Apply YOU patch number 11814.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:suse:suse_linux\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2007/10/19\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2009/09/24\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2009-2021 Tenable Network Security, Inc.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) exit(0, \"Local checks are not enabled.\");\nif (!get_kb_item(\"Host/SuSE/release\")) exit(0, \"The host is not running SuSE.\");\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) exit(1, \"Could not obtain the list of installed packages.\");\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) exit(1, \"Failed to determine the architecture type.\");\nif (cpu >!< \"x86_64\" && cpu !~ \"^i[3-6]86$\") exit(1, \"Local checks for SuSE 9 on the '\"+cpu+\"' architecture have not been implemented.\");\n\n\nflag = 0;\nif (rpm_check(release:\"SUSE9\", reference:\"fetchmail-6.2.5-49.17\")) flag++;\nif (rpm_check(release:\"SUSE9\", reference:\"fetchmailconf-6.2.5-49.17\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse exit(0, \"The host is not affected.\");\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-05-18T15:31:22", "description": "Matthias Andree reports :\n\nWhen a log message exceeds c. 2 kByte in size, for instance, with very long header contents, and depending on verbosity option, fetchmail can crash or misreport each first log message that requires a buffer reallocation.", "cvss3": {}, "published": "2021-07-30T00:00:00", "type": "nessus", "title": "FreeBSD : fetchmail -- 6.4.19 and older denial of service or information disclosure (cbfd1874-efea-11eb-8fe9-036bd763ff35)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2008-2711", "CVE-2021-36386"], "modified": "2021-08-11T00:00:00", "cpe": ["p-cpe:/a:freebsd:freebsd:fetchmail", "cpe:/o:freebsd:freebsd"], "id": "FREEBSD_PKG_CBFD1874EFEA11EB8FE9036BD763FF35.NASL", "href": "https://www.tenable.com/plugins/nessus/152150", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from the FreeBSD VuXML database :\n#\n# Copyright 2003-2021 Jacques Vidrine and contributors\n#\n# Redistribution and use in source (VuXML) and 'compiled' forms (SGML,\n# HTML, PDF, PostScript, RTF and so forth) with or without modification,\n# are permitted provided that the following conditions are met:\n# 1. Redistributions of source code (VuXML) must retain the above\n# copyright notice, this list of conditions and the following\n# disclaimer as the first lines of this file unmodified.\n# 2. Redistributions in compiled form (transformed to other DTDs,\n# published online in any format, converted to PDF, PostScript,\n# RTF and other formats) must reproduce the above copyright\n# notice, this list of conditions and the following disclaimer\n# in the documentation and/or other materials provided with the\n# distribution.\n# \n# THIS DOCUMENTATION IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS \"AS IS\"\n# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,\n# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR\n# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS\n# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,\n# OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT\n# OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR\n# BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,\n# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE\n# OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS DOCUMENTATION,\n# EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(152150);\n script_version(\"1.4\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/08/11\");\n\n script_cve_id(\"CVE-2008-2711\", \"CVE-2021-36386\");\n\n script_name(english:\"FreeBSD : fetchmail -- 6.4.19 and older denial of service or information disclosure (cbfd1874-efea-11eb-8fe9-036bd763ff35)\");\n script_summary(english:\"Checks for updated packages in pkg_info output\");\n\n script_set_attribute(\n attribute:\"synopsis\",\n value:\n\"The remote FreeBSD host is missing one or more security-related\nupdates.\"\n );\n script_set_attribute(\n attribute:\"description\",\n value:\n\"Matthias Andree reports :\n\nWhen a log message exceeds c. 2 kByte in size, for instance, with very\nlong header contents, and depending on verbosity option, fetchmail can\ncrash or misreport each first log message that requires a buffer\nreallocation.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://sourceforge.net/p/fetchmail/mailman/message/37327392/\"\n );\n # https://vuxml.freebsd.org/freebsd/cbfd1874-efea-11eb-8fe9-036bd763ff35.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?37ccbbb8\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2021-36386\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n script_cwe_id(20);\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:freebsd:freebsd:fetchmail\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:freebsd:freebsd\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2021/07/07\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2021/07/28\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2021/07/30\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"FreeBSD Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/FreeBSD/release\", \"Host/FreeBSD/pkg_info\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"freebsd_package.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/FreeBSD/release\")) audit(AUDIT_OS_NOT, \"FreeBSD\");\nif (!get_kb_item(\"Host/FreeBSD/pkg_info\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\n\nif (pkg_test(save_report:TRUE, pkg:\"fetchmail<6.3.9\")) flag++;\nif (pkg_test(save_report:TRUE, pkg:\"fetchmail>=6.3.17<6.4.20\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:pkg_report_get());\n else security_warning(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-05-18T15:02:25", "description": "Gaetan Leurent discovered a vulnerability in the APOP protocol based on MD5 collisions. As fetchmail supports the APOP protocol, this vulnerability can be used by attackers to discover a portion of the APOP user's authentication credentials. (CVE-2007-1558)\n\nEarl Chew discovered that fetchmail can be made to de-reference a NULL pointer when contacting SMTP servers. This vulnerability can be used by attackers who control the SMTP server to crash fetchmail and cause a denial of service. (CVE-2007-4565).\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {}, "published": "2007-11-10T00:00:00", "type": "nessus", "title": "Ubuntu 6.06 LTS / 6.10 / 7.04 : fetchmail vulnerabilities (USN-520-1)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2007-1558", "CVE-2007-4565"], "modified": "2021-01-19T00:00:00", "cpe": ["p-cpe:/a:canonical:ubuntu_linux:fetchmail", "p-cpe:/a:canonical:ubuntu_linux:fetchmailconf", "cpe:/o:canonical:ubuntu_linux:6.06:-:lts", "cpe:/o:canonical:ubuntu_linux:6.10", "cpe:/o:canonical:ubuntu_linux:7.04"], "id": "UBUNTU_USN-520-1.NASL", "href": "https://www.tenable.com/plugins/nessus/28125", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Ubuntu Security Notice USN-520-1. The text \n# itself is copyright (C) Canonical, Inc. See \n# <http://www.ubuntu.com/usn/>. Ubuntu(R) is a registered \n# trademark of Canonical, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(28125);\n script_version(\"1.15\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/19\");\n\n script_cve_id(\"CVE-2007-1558\", \"CVE-2007-4565\");\n script_xref(name:\"USN\", value:\"520-1\");\n\n script_name(english:\"Ubuntu 6.06 LTS / 6.10 / 7.04 : fetchmail vulnerabilities (USN-520-1)\");\n script_summary(english:\"Checks dpkg output for updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\n\"The remote Ubuntu host is missing one or more security-related\npatches.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Gaetan Leurent discovered a vulnerability in the APOP protocol based\non MD5 collisions. As fetchmail supports the APOP protocol, this\nvulnerability can be used by attackers to discover a portion of the\nAPOP user's authentication credentials. (CVE-2007-1558)\n\nEarl Chew discovered that fetchmail can be made to de-reference a NULL\npointer when contacting SMTP servers. This vulnerability can be used\nby attackers who control the SMTP server to crash fetchmail and cause\na denial of service. (CVE-2007-4565).\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Ubuntu security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://usn.ubuntu.com/520-1/\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected fetchmail and / or fetchmailconf packages.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:fetchmail\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:fetchmailconf\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:6.06:-:lts\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:6.10\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:7.04\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2007/09/25\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2007/11/10\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"Ubuntu Security Notice (C) 2007-2019 Canonical, Inc. / NASL script (C) 2018 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Ubuntu Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/cpu\", \"Host/Ubuntu\", \"Host/Ubuntu/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"ubuntu.inc\");\ninclude(\"misc_func.inc\");\n\nif ( ! get_kb_item(\"Host/local_checks_enabled\") ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/Ubuntu/release\");\nif ( isnull(release) ) audit(AUDIT_OS_NOT, \"Ubuntu\");\nrelease = chomp(release);\nif (! ereg(pattern:\"^(6\\.06|6\\.10|7\\.04)$\", string:release)) audit(AUDIT_OS_NOT, \"Ubuntu 6.06 / 6.10 / 7.04\", \"Ubuntu \" + release);\nif ( ! get_kb_item(\"Host/Debian/dpkg-l\") ) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Ubuntu\", cpu);\n\nflag = 0;\n\nif (ubuntu_check(osver:\"6.06\", pkgname:\"fetchmail\", pkgver:\"6.3.2-2ubuntu2.2\")) flag++;\nif (ubuntu_check(osver:\"6.06\", pkgname:\"fetchmailconf\", pkgver:\"6.3.2-2ubuntu2.2\")) flag++;\nif (ubuntu_check(osver:\"6.10\", pkgname:\"fetchmail\", pkgver:\"6.3.4-1ubuntu4.2\")) flag++;\nif (ubuntu_check(osver:\"6.10\", pkgname:\"fetchmailconf\", pkgver:\"6.3.4-1ubuntu4.2\")) flag++;\nif (ubuntu_check(osver:\"7.04\", pkgname:\"fetchmail\", pkgver:\"6.3.6-1ubuntu2.1\")) flag++;\nif (ubuntu_check(osver:\"7.04\", pkgname:\"fetchmailconf\", pkgver:\"6.3.6-1ubuntu2.1\")) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : ubuntu_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = ubuntu_pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"fetchmail / fetchmailconf\");\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-05-18T14:19:48", "description": "The remote host is running a version of Mac OS X 10.5 or 10.4 that does not have Security Update 2009-001 applied.\n\nThis security update contains fixes for the following products :\n\n - AFP Server\n - Apple Pixlet Video\n - CarbonCore\n - CFNetwork\n - Certificate Assistant\n - ClamAV\n - CoreText\n - CUPS\n - DS Tools\n - fetchmail\n - Folder Manager\n - FSEvents\n - Network Time\n - perl\n - Printing\n - python\n - Remote Apple Events\n - Safari RSS\n - servermgrd\n - SMB\n - SquirrelMail\n - X11\n - XTerm", "cvss3": {}, "published": "2009-02-13T00:00:00", "type": "nessus", "title": "Mac OS X Multiple Vulnerabilities (Security Update 2009-001)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2006-1861", "CVE-2006-3467", "CVE-2007-1351", "CVE-2007-1352", "CVE-2007-1667", "CVE-2007-4565", "CVE-2007-4965", "CVE-2008-1377", "CVE-2008-1379", "CVE-2008-1679", "CVE-2008-1721", "CVE-2008-1806", "CVE-2008-1807", "CVE-2008-1808", "CVE-2008-1887", "CVE-2008-1927", "CVE-2008-2315", "CVE-2008-2316", "CVE-2008-2360", "CVE-2008-2361", "CVE-2008-2362", "CVE-2008-2379", "CVE-2008-2711", "CVE-2008-3142", "CVE-2008-3144", "CVE-2008-3663", "CVE-2008-4864", "CVE-2008-5031", "CVE-2008-5050", "CVE-2008-5183", "CVE-2008-5314", "CVE-2009-0009", "CVE-2009-0011", "CVE-2009-0012", "CVE-2009-0013", "CVE-2009-0014", "CVE-2009-0015", "CVE-2009-0017", "CVE-2009-0018", "CVE-2009-0019", "CVE-2009-0020", "CVE-2009-0137", "CVE-2009-0138", "CVE-2009-0139", "CVE-2009-0140", "CVE-2009-0141", "CVE-2009-0142"], "modified": "2018-07-16T00:00:00", "cpe": ["cpe:/o:apple:mac_os_x"], "id": "MACOSX_SECUPD2009-001.NASL", "href": "https://www.tenable.com/plugins/nessus/35684", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n\n\nif (!defined_func(\"bn_random\")) exit(0);\nif (NASL_LEVEL < 3004) exit(0);\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(35684);\n script_version(\"1.32\");\n script_cvs_date(\"Date: 2018/07/16 12:48:31\");\n\n script_cve_id(\"CVE-2006-1861\", \"CVE-2006-3467\", \"CVE-2007-1351\", \"CVE-2007-1352\", \"CVE-2007-1667\",\n \"CVE-2007-4565\", \"CVE-2007-4965\", \"CVE-2008-1377\", \"CVE-2008-1379\", \"CVE-2008-1679\",\n \"CVE-2008-1721\", \"CVE-2008-1806\", \"CVE-2008-1807\", \"CVE-2008-1808\", \"CVE-2008-1887\",\n \"CVE-2008-1927\", \"CVE-2008-2315\", \"CVE-2008-2316\", \"CVE-2008-2360\", \"CVE-2008-2361\",\n \"CVE-2008-2362\", \"CVE-2008-2379\", \"CVE-2008-2711\", \"CVE-2008-3142\", \"CVE-2008-3144\",\n \"CVE-2008-3663\", \"CVE-2008-4864\", \"CVE-2008-5031\", \"CVE-2008-5050\", \"CVE-2008-5183\",\n \"CVE-2008-5314\", \"CVE-2009-0009\", \"CVE-2009-0011\", \"CVE-2009-0012\", \"CVE-2009-0013\",\n \"CVE-2009-0014\", \"CVE-2009-0015\", \"CVE-2009-0017\", \"CVE-2009-0018\", \"CVE-2009-0019\",\n \"CVE-2009-0020\", \"CVE-2009-0137\", \"CVE-2009-0138\", \"CVE-2009-0139\", \"CVE-2009-0140\",\n \"CVE-2009-0141\", \"CVE-2009-0142\");\n script_bugtraq_id(25495, 25696, 28715, 28749, 28928, 29705, 30491, 31976, 32207, 32555,\n 33187, 33796, 33798, 33800, 33806, 33808, 33809, 33810, 33811, 33812,\n 33813, 33814, 33815, 33816, 33820, 33821);\n\n script_name(english:\"Mac OS X Multiple Vulnerabilities (Security Update 2009-001)\");\n script_summary(english:\"Check for the presence of Security Update 2009-001\");\n\n script_set_attribute( attribute:\"synopsis\", value:\n\"The remote host is missing a Mac OS X update that fixes various\nsecurity issues.\" );\n script_set_attribute( attribute:\"description\", value:\n\"The remote host is running a version of Mac OS X 10.5 or 10.4 that\ndoes not have Security Update 2009-001 applied.\n\nThis security update contains fixes for the following products :\n\n - AFP Server\n - Apple Pixlet Video\n - CarbonCore\n - CFNetwork\n - Certificate Assistant\n - ClamAV\n - CoreText\n - CUPS\n - DS Tools\n - fetchmail\n - Folder Manager\n - FSEvents\n - Network Time\n - perl\n - Printing\n - python\n - Remote Apple Events\n - Safari RSS\n - servermgrd\n - SMB\n - SquirrelMail\n - X11\n - XTerm\" );\n script_set_attribute(\n attribute:\"see_also\", \n value:\"http://support.apple.com/kb/ht3438\"\n );\n script_set_attribute(\n attribute:\"see_also\", \n value:\"http://lists.apple.com/archives/security-announce/2009/Feb/msg00000.html\"\n );\n script_set_attribute( attribute:\"solution\", value:\n \"Install Security Update 2009-001 or later.\" );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:H/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"exploited_by_malware\", value:\"true\");\n script_cwe_id(20, 79, 119, 189, 255, 264, 287, 310, 362, 399);\n script_set_attribute(attribute:\"plugin_publication_date\", value: \"2009/02/13\");\n script_set_attribute(attribute:\"patch_publication_date\", value: \"2009/02/12\");\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:apple:mac_os_x\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"MacOS X Local Security Checks\");\n script_copyright(english:\"This script is Copyright (C) 2009-2018 Tenable Network Security, Inc.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/MacOSX/packages\", \"Host/uname\");\n exit(0);\n}\n\n#\n\nuname = get_kb_item(\"Host/uname\");\nif (!uname) exit(1, \"The 'Host/uname' KB item is missing.\");\n\nif (egrep(pattern:\"Darwin.* (8\\.[0-9]\\.|8\\.1[01]\\.)\", string:uname))\n{\n packages = get_kb_item(\"Host/MacOSX/packages\");\n if (!packages) exit(1, \"The 'Host/MacOSX/packages' KB item is missing.\");\n\n if (egrep(pattern:\"^SecUpd(Srvr)?(2009-00[1-9]|20[1-9][0-9]-)\", string:packages))\n exit(0, \"The host has Security Update 2009-001 or later installed and therefore is not affected.\");\n else\n security_hole(0);\n}\nelse if (egrep(pattern:\"Darwin.* (9\\.[0-6]\\.)\", string:uname))\n{\n packages = get_kb_item(\"Host/MacOSX/packages/boms\");\n if (!packages) exit(1, \"The 'Host/MacOSX/packages/boms' KB item is missing.\");\n\n if (egrep(pattern:\"^com\\.apple\\.pkg\\.update\\.security\\.(2009\\.00[1-9]|20[1-9][0-9]\\.[0-9]+)\\.bom\", string:packages))\n exit(0, \"The host has Security Update 2009-001 or later installed and therefore is not affected.\");\n else\n security_hole(0);\n}\nelse exit(0, \"The host is not affected.\");\n", "cvss": {"score": 0.0, "vector": "NONE"}}], "centos": [{"lastseen": "2023-05-31T16:17:11", "description": "**CentOS Errata and Security Advisory** CESA-2009:1427\n\n\nFetchmail is a remote mail retrieval and forwarding utility intended for\nuse over on-demand TCP/IP links, such as SLIP and PPP connections.\n\nIt was discovered that fetchmail is affected by the previously published\n\"null prefix attack\", caused by incorrect handling of NULL characters in\nX.509 certificates. If an attacker is able to get a carefully-crafted\ncertificate signed by a trusted Certificate Authority, the attacker could\nuse the certificate during a man-in-the-middle attack and potentially\nconfuse fetchmail into accepting it by mistake. (CVE-2009-2666)\n\nA flaw was found in the way fetchmail handles rejections from a remote SMTP\nserver when sending warning mail to the postmaster. If fetchmail sent a\nwarning mail to the postmaster of an SMTP server and that SMTP server\nrejected it, fetchmail could crash. (CVE-2007-4565)\n\nA flaw was found in fetchmail. When fetchmail is run in double verbose\nmode (\"-v -v\"), it could crash upon receiving certain, malformed mail\nmessages with long headers. A remote attacker could use this flaw to cause\na denial of service if fetchmail was also running in daemon mode (\"-d\").\n(CVE-2008-2711)\n\nNote: when using SSL-enabled services, it is recommended that the fetchmail\n\"--sslcertck\" option be used to enforce strict SSL certificate checking.\n\nAll fetchmail users should upgrade to this updated package, which contains\nbackported patches to correct these issues. If fetchmail is running in\ndaemon mode, it must be restarted for this update to take effect (use the\n\"fetchmail --quit\" command to stop the fetchmail process).\n\n**Merged security bulletin from advisories:**\nhttps://lists.centos.org/pipermail/centos-announce/2009-October/065701.html\nhttps://lists.centos.org/pipermail/centos-announce/2009-October/065702.html\nhttps://lists.centos.org/pipermail/centos-announce/2009-September/065600.html\nhttps://lists.centos.org/pipermail/centos-announce/2009-September/065601.html\nhttps://lists.centos.org/pipermail/centos-announce/2009-September/065602.html\nhttps://lists.centos.org/pipermail/centos-announce/2009-September/065603.html\nhttps://lists.centos.org/pipermail/centos-announce/2009-September/065634.html\nhttps://lists.centos.org/pipermail/centos-announce/2009-September/065635.html\n\n**Affected packages:**\nfetchmail\n\n**Upstream details at:**\nhttps://access.redhat.com/errata/RHSA-2009:1427", "cvss3": {}, "published": "2009-09-08T17:07:54", "type": "centos", "title": "fetchmail security update", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 6.4, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 4.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2007-4565", "CVE-2008-2711", "CVE-2009-2666"], "modified": "2009-10-30T14:43:49", "id": "CESA-2009:1427", "href": "https://lists.centos.org/pipermail/centos-announce/2009-September/065600.html", "cvss": {"score": 6.4, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:N"}}], "fedora": [{"lastseen": "2020-12-21T08:17:49", "description": "Fetchmail is a remote mail retrieval and forwarding utility intended for use over on-demand TCP/IP links, like SLIP or PPP connections. Fetchmail supports every remote-mail protocol currently in use on the Internet (POP2, POP3, RPOP, APOP, KPOP, all IMAPs, ESMTP ETRN, IPv6, and IPSEC) for retrieval. Then Fetchmail forwards the mail through SMTP so you can read it through your favorite mail client. Install fetchmail if you need to retrieve mail over SLIP or PPP connections. ", "cvss3": {}, "published": "2008-06-28T22:15:01", "type": "fedora", "title": "[SECURITY] Fedora 9 Update: fetchmail-6.3.8-7.fc9", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "PARTIAL", "integrityImpact": "NONE", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2008-2711"], "modified": "2008-06-28T22:15:01", "id": "FEDORA:M5SMESRC003240", "href": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/2JB5EJJUSVTKHRKMRUOLSJFZ7SD5Q2TI/", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2020-12-21T08:17:49", "description": "Fetchmail is a remote mail retrieval and forwarding utility intended for use over on-demand TCP/IP links, like SLIP or PPP connections. Fetchmail supports every remote-mail protocol currently in use on the Internet (POP2, POP3, RPOP, APOP, KPOP, all IMAPs, ESMTP ETRN, IPv6, and IPSEC) for retrieval. Then Fetchmail forwards the mail through SMTP so you can read it through your favorite mail client. Install fetchmail if you need to retrieve mail over SLIP or PPP connections. ", "cvss3": {}, "published": "2008-06-28T22:15:22", "type": "fedora", "title": "[SECURITY] Fedora 8 Update: fetchmail-6.3.8-4.fc8", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "PARTIAL", "integrityImpact": "NONE", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2008-2711"], "modified": "2008-06-28T22:15:22", "id": "FEDORA:M5SMFHKA003295", "href": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/IXYVY5KKTZBIR6RKPGOG4O6XUEAL7IH2/", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2020-12-21T08:17:48", "description": "Fetchmail is a remote mail retrieval and forwarding utility intended for use over on-demand TCP/IP links, like SLIP or PPP connections. Fetchmail supports every remote-mail protocol currently in use on the Internet (POP2, POP3, RPOP, APOP, KPOP, all IMAPs, ESMTP ETRN, IPv6, and IPSEC) for retrieval. Then Fetchmail forwards the mail through SMTP so you can read it through your favorite mail client. Install fetchmail if you need to retrieve mail over SLIP or PPP connections. ", "cvss3": {}, "published": "2007-09-04T22:10:40", "type": "fedora", "title": "[SECURITY] Fedora 7 Update: fetchmail-6.3.7-2.fc7", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "PARTIAL", "integrityImpact": "NONE", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2007-4565"], "modified": "2007-09-04T22:10:40", "id": "FEDORA:L84MAGHD029693", "href": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/KEEB6UKEMULQE75HBP43EUGMKB5XF7BF/", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2020-12-21T08:17:48", "description": "Fetchmail is a remote mail retrieval and forwarding utility intended for use over on-demand TCP/IP links, like SLIP or PPP connections. Fetchmail supports every remote-mail protocol currently in use on the Internet (POP2, POP3, RPOP, APOP, KPOP, all IMAPs, ESMTP ETRN, IPv6, and IPSEC) for retrieval. Then Fetchmail forwards the mail through SMTP so you can read it through your favorite mail client. Install fetchmail if you need to retrieve mail over SLIP or PPP connections. ", "cvss3": {}, "published": "2007-09-04T21:26:32", "type": "fedora", "title": "[SECURITY] Fedora Core 6 Update: fetchmail-6.3.6-3.fc6", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "PARTIAL", "integrityImpact": "NONE", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2007-4565"], "modified": "2007-09-04T21:26:32", "id": "FEDORA:L84LQWGQ024974", "href": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/YMPQXDADQ5VQLRDPULSDH5OKXEREAAI7/", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}], "seebug": [{"lastseen": "2017-11-19T21:38:00", "description": "BUGTRAQ ID: 29705\r\nCVE(CAN) ID: CVE-2008-2711\r\n\r\nFetchmail\u662f\u514d\u8d39\u7684\u8f6f\u4ef6\u5305\uff0c\u53ef\u4ee5\u4ece\u8fdc\u7a0bPOP2\u3001POP3\u3001IMAP\u3001ETRN\u6216ODMR\u670d\u52a1\u5668\u68c0\u7d22\u90ae\u4ef6\u5e76\u5c06\u5176\u8f6c\u53d1\u7ed9\u672c\u5730SMTP\u3001LMTP\u670d\u52a1\u5668\u6216\u6d88\u606f\u4f20\u9001\u4ee3\u7406\u3002\r\n\r\nFetchmail\u5728\u5904\u7406\u6d88\u606f\u65f6\u5b58\u5728\u5185\u5b58\u8bbf\u95ee\u9519\u8bef\uff0c\u4ee5-v -v verbose\u7ea7\u522b\u8fd0\u884c\u7684fetchmail\u5728\u8bd5\u56fe\u6253\u5370\u8d85\u8fc72048\u5b57\u8282\u7684\u5934\u65f6\u4f1a\u91cd\u65b0\u8c03\u6574\u7f13\u51b2\u533a\u5927\u5c0f\u5e76\u586b\u5145\u6d88\u606f\u7684\u591a\u51fa\u90e8\u5206\uff0c\u4f46\u6ca1\u6709\u91cd\u65b0\u521d\u59cb\u5316\u5176 va_list\u7c7b\u578b\u7684\u6e90\u6307\u9488\uff0c\u56e0\u6b64\u53ef\u80fd\u4f1a\u5728\u6808\u4e0a\u7684\u65e0\u6548\u5730\u5740\u8bfb\u53d6\u6570\u636e\uff0c\u5bfc\u81f4\u51fa\u73b0\u5206\u6bb5\u9519\u8bef\u800c\u5d29\u6e83\u3002\n\nfetchmail < 6.3.9\n \u4e34\u65f6\u89e3\u51b3\u65b9\u6cd5\uff1a\r\n\r\n* \u4ee5\u4f4everbosity\u8fd0\u884cfetchmail\uff0c\u4e0d\u8981\u4f7f\u7528\u4e24\u4e2a\u6216\u4e09\u4e2a-v\u53c2\u6570\u3002\r\n\r\n\u5382\u5546\u8865\u4e01\uff1a\r\n\r\nfetchmail\r\n---------\r\n\u76ee\u524d\u5382\u5546\u5df2\u7ecf\u53d1\u5e03\u4e86\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u8fd9\u4e2a\u5b89\u5168\u95ee\u9898\uff0c\u8bf7\u5230\u5382\u5546\u7684\u4e3b\u9875\u4e0b\u8f7d\uff1a\r\n\r\n<a href=http://developer.berlios.de/patch/?func=detailpatch&patch_id=2492&group_id=1824 target=_blank>http://developer.berlios.de/patch/?func=detailpatch&patch_id=2492&group_id=1824</a>", "cvss3": {}, "published": "2008-06-20T00:00:00", "type": "seebug", "title": "Fetchmail Verbose\u6a21\u5f0f\u8d85\u5927\u65e5\u5fd7\u6d88\u606f\u8fdc\u7a0b\u62d2\u7edd\u670d\u52a1\u6f0f\u6d1e", "bulletinFamily": "exploit", "cvss2": {}, "cvelist": ["CVE-2008-2711"], "modified": "2008-06-20T00:00:00", "href": "https://www.seebug.org/vuldb/ssvid-3436", "id": "SSV:3436", "sourceData": "", "sourceHref": "", "cvss": {"score": 4.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}}, {"lastseen": "2017-11-19T22:02:14", "description": "BUGTRAQ ID: 25495\r\nCVE(CAN) ID: CVE-2007-4565\r\n\r\nFetchmail\u662f\u514d\u8d39\u7684\u8f6f\u4ef6\u5305\uff0c\u53ef\u4ee5\u4ece\u8fdc\u7a0bPOP2\u3001POP3\u3001IMAP\u3001ETRN\u6216ODMR\u670d\u52a1\u5668\u68c0\u7d22\u90ae\u4ef6\u5e76\u5c06\u5176\u8f6c\u53d1\u7ed9\u672c\u5730SMTP\u3001LMTP\u670d\u52a1\u5668\u6216\u6d88\u606f\u4f20\u9001\u4ee3\u7406\u3002\r\n\r\n\u5728\u67d0\u4e9b\u60c5\u51b5\u4e0bFetchmail\u4f1a\u751f\u6210\u8b66\u544a\u6d88\u606f\u5e76\u53d1\u9001\u7ed9\u7ba1\u7406\u5458\u4fe1\u7bb1\u6216\u542f\u52a8Fetchmail\u7684\u7528\u6237\uff0c\u4f8b\u5982\uff0c\u5f53\u767b\u5f55\u5230\u4e0a\u6e38\u670d\u52a1\u5668\u53cd\u590d\u5931\u8d25\u6216\u6d88\u606f\u8d85\u8fc7\u5927\u5c0f\u9650\u5236\u65f6\u5c31\u4f1a\u751f\u6210\u8fd9\u6837\u7684\u6d88\u606f\u3002\u5982\u679c\u4e4b\u540eFetchmail\u5c06\u6d88\u606f\u8f6c\u53d1\u5230\u7684SMTP\u76d1\u542c\u7a0b\u5e8f\u62d2\u7edd\u4e86\u8fd9\u4e2a\u8b66\u544a\u6d88\u606f\uff0c\u5728\u8bd5\u56fe\u786e\u5b9a\u662f\u5426\u5e94\u53d1\u9001bounce\u6d88\u606f\u65f6\u4f1a\u5f15\u7528\u7a7a\u6307\u9488\uff0c\u5bfc\u81f4Fetchmail\u5d29\u6e83\uff0c\u5728\u91cd\u542f\u4e4b\u524d\u4e0d\u4f1a\u518d\u6536\u96c6\u4efb\u4f55\u6d88\u606f\u3002\r\n\n\nfetchmail fetchmail < 6.3.9 \r\nfetchmail fetchmail < 4.6.8\n \u76ee\u524d\u5382\u5546\u5df2\u7ecf\u53d1\u5e03\u4e86\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u8fd9\u4e2a\u5b89\u5168\u95ee\u9898\uff0c\u8bf7\u5230\u5382\u5546\u7684\u4e3b\u9875\u4e0b\u8f7d\uff1a\r\n\r\n<a href=\"http://fetchmail.berlios.de/\" target=\"_blank\">http://fetchmail.berlios.de/</a>\r\n\r\nIndex: sink.c\r\n===================================================================\r\n--- sink.c (revision 5118)\r\n+++ sink.c (revision 5119)\r\n@@ -262,7 +262,7 @@\r\nconst char *md1 = "MAILER-DAEMON", *md2 = "MAILER-DAEMON@";\r\n\r\n/* don't bounce in reply to undeliverable bounces */\r\n- if (!msg->return_path[0] ||\r\n+ if (!msg || !msg->return_path[0] ||\r\nstrcmp(msg->return_path, "<>") == 0 ||\r\nstrcasecmp(msg->return_path, md1) == 0 ||\r\nstrncasecmp(msg->return_path, md2, strlen(md2)) == 0)", "cvss3": {}, "published": "2007-09-06T00:00:00", "title": "Fetchmail\u65e0\u6548\u8b66\u544a\u6d88\u606f\u672c\u5730\u62d2\u7edd\u670d\u52a1\u6f0f\u6d1e", "type": "seebug", "bulletinFamily": "exploit", "cvss2": {}, "cvelist": ["CVE-2007-4565"], "modified": "2007-09-06T00:00:00", "href": "https://www.seebug.org/vuldb/ssvid-2191", "id": "SSV:2191", "sourceData": "", "sourceHref": "", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}}], "veracode": [{"lastseen": "2022-07-27T10:43:27", "description": "fetchmail is vulnerable to denial of service. A flaw was found in fetchmail. When fetchmail is run in double verbose mode (\"-v -v\"), it could crash upon receiving certain, malformed mail messages with long headers. A remote attacker could use this flaw to cause a denial of service if fetchmail was also running in daemon mode (\"-d\"). \n", "cvss3": {}, "published": "2020-04-10T00:36:12", "type": "veracode", "title": "Denial Of Service (DoS)", "bulletinFamily": "software", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "PARTIAL", "integrityImpact": "NONE", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2008-2711"], "modified": "2020-05-27T05:53:05", "id": "VERACODE:23790", "href": "https://sca.analysiscenter.veracode.com/vulnerability-database/security/1/1/sid-23790/summary", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2022-07-27T10:24:13", "description": "fetchmail is vulnerable to denial of service (DoS). A flaw was found in the way fetchmail handles rejections from a remote SMTP server when sending warning mail to the postmaster. If fetchmail sent a warning mail to the postmaster of an SMTP server and that SMTP server rejected it, fetchmail could crash.\n", "cvss3": {}, "published": "2020-04-10T00:36:11", "type": "veracode", "title": "Denial Of Service (DoS)", "bulletinFamily": "software", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "PARTIAL", "integrityImpact": "NONE", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2007-4565"], "modified": "2022-04-19T18:28:37", "id": "VERACODE:23789", "href": "https://sca.analysiscenter.veracode.com/vulnerability-database/security/1/1/sid-23789/summary", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}], "securityvulns": [{"lastseen": "2018-08-31T11:10:26", "description": "fetchmail-SA-2008-01: Crash on large log messages in verbose mode\r\n\r\nTopics: Crash in large log messages in verbose mode.\r\n\r\nAuthor: Matthias Andree\r\nVersion: 1.0\r\nAnnounced: 2008-06-17\r\nType: Dereferencing garbage pointer trigged by outside circumstances\r\nImpact: denial of service possible\r\nDanger: low\r\nCVSS V2 vector: (AV:N/AC:M/Au:N/C:N/I:N/A:C/E:P/RL:O/RC:C)\r\n\r\nCredits: Petr Uzel (fix), Petr Cerny (analysis), Gunter Nau (bug report)\r\nCVE Name: CVE-2008-2711\r\nURL: http://www.fetchmail.info/fetchmail-SA-2008-01.txt\r\nProject URL: http://www.fetchmail.info/\r\n\r\nAffects: fetchmail release < 6.3.9 exclusively\r\n\r\nNot affected: fetchmail release 6.3.9 and newer\r\n systems without varargs (stdargs.h) support.\r\n\r\nCorrected: 2008-06-13 fetchmail SVN (rev 5193)\r\n\r\nReferences: <https://bugzilla.novell.com/show_bug.cgi?id=354291>\r\n <http://developer.berlios.de/patch/?func=detailpatch&patch_id=2492&group_id=1824>\r\n\r\n\r\n0. Release history\r\n==================\r\n\r\n2008-06-13 1.0 first draft for MITRE/CVE (visible in SVN,\r\n posted to oss-security)\r\n2008-06-17 1.0 published on http://www.fetchmail.info/\r\n\r\n\r\n1. Background\r\n=============\r\n\r\nfetchmail is a software package to retrieve mail from remote POP2, POP3,\r\nIMAP, ETRN or ODMR servers and forward it to local SMTP, LMTP servers or\r\nmessage delivery agents.\r\n\r\nfetchmail ships with a graphical, Python/Tkinter based configuration\r\nutility named "fetchmailconf" to help the user create configuration (run\r\ncontrol) files for fetchmail.\r\n\r\n\r\n2. Problem description and Impact\r\n=================================\r\n\r\nGunter Nau reported fetchmail crashing on some messages; further\r\ndebugging by Petr Uzel and Petr Cerny at Novell/SUSE Czech Republic\r\ndug up that this happened when fetchmail was trying to print, in -v -v\r\nverbose level, headers exceeding 2048 bytes. In this situation,\r\nfetchmail would resize the buffer and fill in further parts of the\r\nmessage, but forget to reinitialize its va_list typed source pointer,\r\nthus reading data from a garbage address found on the stack at\r\naddresses above the function arguments the caller passed in; usually\r\nthat would be the caller's stack frame.\r\n\r\nIt is unknown whether code can be injected remotely, but given that\r\nthe segmentation fault is caused by read accesses, the relevant data\r\nis not under the remote attacker's control and no buffer overrun\r\nsituation is present that would allow altering program /flow/, it is\r\ndeemed rather unlikely that code can be injected.\r\n\r\nNote that the required -vv configuration at hand is both non-default\r\nand also not common in automated (cron job) setups, but usually used\r\nin manual debugging, so not many systems would be affected by the\r\nproblem. Nonetheless, in vulnerable configurations, it is remotely\r\nexploitable to effect a denial of service attack.\r\n\r\n\r\n\r\n3. Solution\r\n===========\r\n\r\nThere are two alternatives, either of them by itself is sufficient:\r\n\r\na. Apply the patch found in section B of this announcement to\r\n fetchmail 6.3.8, recompile and reinstall it.\r\n\r\nb. Install fetchmail 6.3.9 or newer after it will have become available.\r\n The fetchmail source code is always available from\r\n <http://developer.berlios.de/project/showfiles.php?group_id=1824>.\r\n\r\n\r\n4. Workaround\r\n=============\r\n\r\nRun fetchmail at low verbosity, avoid using two or three -v arguments;\r\ninternal messages are short and do not contain external message\r\nsources so they do not cause buffer resizing. It is recommended to\r\nreplace the vulnerable code by a fixed version (see previous\r\nsection 3. Solution) as soon as reasonably possible.\r\n\r\n\r\nA. Copyright, License and Warranty\r\n==================================\r\n\r\n(C) Copyright 2008 by Matthias Andree, <matthias.andree@gmx.de>.\r\nSome rights reserved.\r\n\r\nThis work is licensed under the Creative Commons\r\nAttribution-NonCommercial-NoDerivs German License. To view a copy of\r\nthis license, visit http://creativecommons.org/licenses/by-nc-nd/2.0/de/\r\nor send a letter to Creative Commons; 559 Nathan Abbott Way;\r\nStanford, California 94305; USA.\r\n\r\nTHIS WORK IS PROVIDED FREE OF CHARGE AND WITHOUT ANY WARRANTIES.\r\nUse the information herein at your own risk.\r\n\r\n\r\n\r\nB. Patch to remedy the problem\r\n==============================\r\n\r\ndiff --git a/report.c b/report.c\r\nindex 31d4e48..2a731ac 100644\r\n--- a/report.c\r\n+++ b/report.c\r\n@@ -238,11 +238,17 @@ report_build (FILE *errfp, message, va_alist)\r\n rep_ensuresize();\r\n \r\n #if defined(VA_START)\r\n- VA_START (args, message);\r\n for ( ; ; )\r\n {\r\n+ /*\r\n+ * args has to be initialized before every call of vsnprintf(), \r\n+ * because vsnprintf() invokes va_arg macro and thus args is \r\n+ * undefined after the call.\r\n+ */\r\n+ VA_START(args, message);\r\n n = vsnprintf (partial_message + partial_message_size_used, partial_message_size -\r\npartial_message_size_used,\r\n message, args);\r\n+ va_end (args);\r\n \r\n if (n >= 0\r\n && (unsigned)n < partial_message_size - partial_message_size_used)\r\n@@ -254,7 +260,6 @@ report_build (FILE *errfp, message, va_alist)\r\n partial_message_size += 2048;\r\n partial_message = REALLOC (partial_message, partial_message_size);\r\n }\r\n- va_end (args);\r\n #else\r\n for ( ; ; )\r\n {\r\n\r\nEND OF fetchmail-SA-2008-01.txt", "cvss3": {}, "published": "2008-06-17T00:00:00", "type": "securityvulns", "title": "fetchmail security announcement fetchmail-SA-2008-01 (CVE-2008-2711)", "bulletinFamily": "software", "hackapp": {}, "cvss2": {}, "cvelist": ["CVE-2008-2711"], "modified": "2008-06-17T00:00:00", "id": "SECURITYVULNS:DOC:20058", "href": "https://vulners.com/securityvulns/SECURITYVULNS:DOC:20058", "sourceData": "", "cvss": {"score": 4.3, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}}, {"lastseen": "2018-08-31T11:10:23", "description": "rPath Security Advisory: 2007-0178-1\r\nPublished: 2007-09-05\r\nProducts: rPath Linux 1\r\nRating: Minor\r\nExposure Level Classification:\r\nIndirect User Non-deterministic Denial of Service\r\nUpdated Versions:\r\nfetchmail=/conary.rpath.com@rpl:devel//1/6.3.8-0.3-1\r\n\r\nReferences:\r\nhttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4565\r\nhttps://issues.rpath.com/browse/RPL-1690\r\n\r\nDescription:\r\nPrevious versions of the fetchmail package may crash when attempting\r\nto deliver an internal warning or error message through an untrusted\r\nor compromised SMTP server, leading to a possible Denial of Service.\r\n\r\nCopyright 2007 rPath, Inc.\r\nThis file is distributed under the terms of the MIT License.\r\nA copy is available at http://www.rpath.com/permanent/mit-license.html\r\n", "cvss3": {}, "published": "2007-09-06T00:00:00", "type": "securityvulns", "title": "rPSA-2007-0178-1 fetchmail", "bulletinFamily": "software", "hackapp": {}, "cvss2": {}, "cvelist": ["CVE-2007-4565"], "modified": "2007-09-06T00:00:00", "id": "SECURITYVULNS:DOC:17944", "href": "https://vulners.com/securityvulns/SECURITYVULNS:DOC:17944", "sourceData": "", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}}, {"lastseen": "2018-08-31T11:10:26", "description": "fetchmail-SA-2007-02: Crash when a local warning message is rejected\r\n\r\nTopics: Crash when a fetchmail-generated warning message is rejected\r\n\r\nAuthor: Matthias Andree\r\nVersion: 1.1\r\nAnnounced: 2007-08-28\r\nType: NULL pointer dereference trigged by outside circumstances\r\nImpact: denial of service possible\r\nDanger: low\r\nCVSS V2 vector: (AV:N/AC:M/Au:N/C:N/I:N/A:C/E:?/RL:O/RC:C)\r\n \r\nCredits: Earl Chew\r\nCVE Name: CVE-2007-4565\r\nURL: http://www.fetchmail.info/fetchmail-SA-2007-02.txt\r\nProject URL: http://www.fetchmail.info/\r\n\r\nAffects: fetchmail release < 6.3.9 exclusively\r\n\r\nNot affected: fetchmail release 6.3.9 and newer\r\n fetchmail releases < 4.6.8 exclusively\r\n\r\nCorrected: 2007-07-29 fetchmail SVN (rev 5119)\r\n\r\n\r\n0. Release history\r\n==================\r\n\r\n2007-07-29 1.0 first draft for MITRE/CVE (visible in SVN)\r\n2007-08-28 1.1 reworked, added fix, official release\r\n\r\n\r\n1. Background\r\n=============\r\n\r\nfetchmail is a software package to retrieve mail from remote POP2, POP3,\r\nIMAP, ETRN or ODMR servers and forward it to local SMTP, LMTP servers or\r\nmessage delivery agents.\r\n\r\nfetchmail ships with a graphical, Python/Tkinter based configuration\r\nutility named "fetchmailconf" to help the user create configuration (run\r\ncontrol) files for fetchmail.\r\n\r\n\r\n2. Problem description and Impact\r\n=================================\r\n\r\nfetchmail will generate warning messages in certain circumstances and \r\nsend them to the local postmaster or the user starting it. Such warning \r\nmessages can be generated, for instance, if logging into an upstream \r\nserver fails repeatedly or if messages beyond the size limit (if \r\nconfigured, default: no limit) are left on the server.\r\n\r\nIf this warning message is then refused by the SMTP listener that \r\nfetchmail is forwarding the message to, fetchmail attempts to \r\ndereference a NULL pointer when trying to find out if it should allow a \r\nbounce message to be sent.\r\n\r\nThis causes fetchmail to crash and not collect further messages until it \r\nis restarted.\r\n\r\nRisk assessment: low. In default configuration, fetchmail will talk \r\nthrough the loopback interface, that means to the SMTP server on the same \r\ncomputer as it is running on. Otherwise, it will commonly be configured \r\nto talk to trusted SMTP servers, so a compromise or misconfiguration of \r\na trusted or the same computer is required to exploit this problem - \r\nwhich usually opens up much easier ways of denying service, or worse.\r\n\r\n\r\n3. Solution\r\n===========\r\n\r\nThere are two alternatives, either of them by itself is sufficient:\r\n\r\na. Apply the patch found in section B of this announcement to fetchmail 6.3.8,\r\n recompile and reinstall it.\r\n\r\nb. Install fetchmail 6.3.9 or newer when it becomes available. The \r\n fetchmail source code is available from \r\n <http://developer.berlios.de/project/showfiles.php?group_id=1824>.\r\n\r\nNote there are no workarounds presented here since all known workarounds \r\nare more intrusive than the actual solution.\r\n\r\n\r\nA. Copyright, License and Warranty\r\n==================================\r\n\r\n(C) Copyright 2007 by Matthias Andree, <matthias.andree@gmx.de>.\r\nSome rights reserved.\r\n\r\nThis work is licensed under the Creative Commons\r\nAttribution-NonCommercial-NoDerivs German License. To view a copy of\r\nthis license, visit http://creativecommons.org/licenses/by-nc-nd/2.0/de/\r\nor send a letter to Creative Commons; 559 Nathan Abbott Way;\r\nStanford, California 94305; USA.\r\n\r\nTHIS WORK IS PROVIDED FREE OF CHARGE AND WITHOUT ANY WARRANTIES.\r\nUse the information herein at your own risk.\r\n\r\n\r\n\r\nB. Patch to remedy the problem\r\n==============================\r\n\r\nIndex: sink.c\r\n===================================================================\r\n--- sink.c (revision 5118)\r\n+++ sink.c (revision 5119)\r\n@@ -262,7 +262,7 @@\r\n const char *md1 = "MAILER-DAEMON", *md2 = "MAILER-DAEMON@";\r\n \r\n /* don't bounce in reply to undeliverable bounces */\r\n- if (!msg->return_path[0] ||\r\n+ if (!msg || !msg->return_path[0] ||\r\n strcmp(msg->return_path, "<>") == 0 ||\r\n strcasecmp(msg->return_path, md1) == 0 ||\r\n strncasecmp(msg->return_path, md2, strlen(md2)) == 0)\r\n\r\nEND OF fetchmail-SA-2007-02.txt", "cvss3": {}, "published": "2008-06-17T00:00:00", "type": "securityvulns", "title": "fetchmail security announcement fetchmail-SA-2007-02 (CVE-2007-4565)", "bulletinFamily": "software", "hackapp": {}, "cvss2": {}, "cvelist": ["CVE-2007-4565"], "modified": "2008-06-17T00:00:00", "id": "SECURITYVULNS:DOC:20057", "href": "https://vulners.com/securityvulns/SECURITYVULNS:DOC:20057", "sourceData": "", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}}, {"lastseen": "2018-08-31T11:09:26", "description": "DoS on delivering mail report thorugh SMTP server.", "cvss3": {}, "published": "2007-09-06T00:00:00", "type": "securityvulns", "title": "Fetchmail mail delivery DoS", "bulletinFamily": "software", "hackapp": {}, "cvss2": {}, "cvelist": ["CVE-2007-4565"], "modified": "2007-09-06T00:00:00", "id": "SECURITYVULNS:VULN:8123", "href": "https://vulners.com/securityvulns/SECURITYVULNS:VULN:8123", "sourceData": "", "cvss": {"score": 5.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:NONE/I:NONE/A:PARTIAL/"}}], "freebsd": [{"lastseen": "2023-06-06T15:28:30", "description": "\n\nMatthias Andree reports:\n\n2008-06-24 1.2 also fixed issue in report_complete (reported by\n\t Petr Uzel)\n\n\n", "cvss3": {}, "published": "2008-06-24T00:00:00", "type": "freebsd", "title": "fetchmail -- potential crash in -v -v verbose mode (revised patch)", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "PARTIAL", "integrityImpact": "NONE", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2008-2711"], "modified": "2008-06-24T00:00:00", "id": "1E8E63C0-478A-11DD-A88D-000EA69A5213", "href": "https://vuxml.freebsd.org/freebsd/1e8e63c0-478a-11dd-a88d-000ea69a5213.html", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2023-06-06T15:28:30", "description": "\n\nMatthias Andree reports:\n\nGunter Nau reported fetchmail crashing on some messages; further\n\t debugging by Petr Uzel and Petr Cerny at Novell/SUSE Czech Republic\n\t dug up that this happened when fetchmail was trying to print, in\n\t -v -v verbose level, headers exceeding 2048 bytes. In this\n\t situation, fetchmail would resize the buffer and fill in further\n\t parts of the message, but forget to reinitialize its va_list\n\t typed source pointer, thus reading data from a garbage address found\n\t on the stack at addresses above the function arguments the caller\n\t passed in; usually that would be the caller's stack frame.\n\n\n", "cvss3": {}, "published": "2008-06-13T00:00:00", "type": "freebsd", "title": "fetchmail -- potential crash in -v -v verbose mode", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "PARTIAL", "integrityImpact": "NONE", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2008-2711"], "modified": "2008-06-13T00:00:00", "id": "168190DF-3E9A-11DD-87BC-000EA69A5213", "href": "https://vuxml.freebsd.org/freebsd/168190df-3e9a-11dd-87bc-000ea69a5213.html", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2023-06-06T15:28:30", "description": "\n\nMatthias Andree reports:\n\nfetchmail will generate warning messages in certain\n\t circumstances (for instance, when leaving oversized messages\n\t on the server or login to the upstream fails) and send them\n\t to the local postmaster or the user running it.\nIf this warning message is then refused by the SMTP listener\n\t that fetchmail is forwarding the message to, fetchmail\n\t crashes and does not collect further messages until it is\n\t restarted.\n\n\n", "cvss3": {}, "published": "2007-07-29T00:00:00", "type": "freebsd", "title": "fetchmail -- denial of service on reject of local warning message", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "PARTIAL", "integrityImpact": "NONE", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2007-4565"], "modified": "2007-07-29T00:00:00", "id": "45500F74-5947-11DC-87C1-000E2E5785AD", "href": "https://vuxml.freebsd.org/freebsd/45500f74-5947-11dc-87c1-000e2e5785ad.html", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2023-06-06T15:28:27", "description": "\n\nMatthias Andree reports:\n\nWhen a log message exceeds c. 2 kByte in size, for instance, with very long\n\t header contents, and depending on verbosity option, fetchmail can crash or\n\t misreport each first log message that requires a buffer reallocation.\n\n\n", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "baseScore": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 3.6}, "published": "2021-07-07T00:00:00", "type": "freebsd", "title": "fetchmail -- 6.4.19 and older denial of service or information disclosure", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "PARTIAL", "integrityImpact": "NONE", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2008-2711", "CVE-2021-36386"], "modified": "2021-08-03T00:00:00", "id": "CBFD1874-EFEA-11EB-8FE9-036BD763FF35", "href": "https://vuxml.freebsd.org/freebsd/cbfd1874-efea-11eb-8fe9-036bd763ff35.html", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}], "slackware": [{"lastseen": "2023-06-06T15:12:40", "description": "New fetchmail packages are available for Slackware 8.1, 9.0, 9.1, 10.0, 10.1,\n10.2, 11.0, 12.0, 12.1, and -current to fix security issues.\n\nMore details about this issue may be found in the Common\nVulnerabilities and Exposures (CVE) database:\n\n https://vulners.com/cve/CVE-2008-2711\n\n\nHere are the details from the Slackware 12.1 ChangeLog:\n\npatches/packages/fetchmail-6.3.8-i486-3_slack12.1.tgz:\n Patched to fix a possible denial of service when \"-v -v\" options are used.\n For more information, see:\n https://vulners.com/cve/CVE-2008-2711\n (* Security fix *)\n\nWhere to find the new packages:\n\nHINT: Getting slow download speeds from ftp.slackware.com?\nGive slackware.osuosl.org a try. This is another primary FTP site\nfor Slackware that can be considerably faster than downloading\ndirectly from ftp.slackware.com.\n\nThanks to the friendly folks at the OSU Open Source Lab\n(http://osuosl.org) for donating additional FTP and rsync hosting\nto the Slackware project! :-)\n\nAlso see the \"Get Slack\" section on http://slackware.com for\nadditional mirror sites near you.\n\nUpdated package for Slackware 8.1:\nftp://ftp.slackware.com/pub/slackware/slackware-8.1/patches/packages/fetchmail-6.3.8-i386-1_slack8.1.tgz\n\nUpdated package for Slackware 9.0:\nftp://ftp.slackware.com/pub/slackware/slackware-9.0/patches/packages/fetchmail-6.3.8-i386-1_slack9.0.tgz\n\nUpdated package for Slackware 9.1:\nftp://ftp.slackware.com/pub/slackware/slackware-9.1/patches/packages/fetchmail-6.3.8-i486-1_slack9.1.tgz\n\nUpdated package for Slackware 10.0:\nftp://ftp.slackware.com/pub/slackware/slackware-10.0/patches/packages/fetchmail-6.3.8-i486-1_slack10.0.tgz\n\nUpdated package for Slackware 10.1:\nftp://ftp.slackware.com/pub/slackware/slackware-10.1/patches/packages/fetchmail-6.3.8-i486-1_slack10.1.tgz\n\nUpdated package for Slackware 10.2:\nftp://ftp.slackware.com/pub/slackware/slackware-10.2/patches/packages/fetchmail-6.3.8-i486-1_slack10.2.tgz\n\nUpdated package for Slackware 11.0:\nftp://ftp.slackware.com/pub/slackware/slackware-11.0/patches/packages/fetchmail-6.3.8-i486-1_slack11.0.tgz\n\nUpdated package for Slackware 12.0:\nftp://ftp.slackware.com/pub/slackware/slackware-12.0/patches/packages/fetchmail-6.3.8-i486-3_slack12.0.tgz\n\nUpdated package for Slackware 12.1:\nftp://ftp.slackware.com/pub/slackware/slackware-12.1/patches/packages/fetchmail-6.3.8-i486-3_slack12.1.tgz\n\nUpdated package for Slackware -current:\nftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/n/fetchmail-6.3.8-i486-3.tgz\n\n\nMD5 signatures:\n\nSlackware 8.1 package:\nb5d8c801042c5190ad8915a30dd0a35f fetchmail-6.3.8-i386-1_slack8.1.tgz\n\nSlackware 9.0 package:\n858b8cbf528801d500db9c8353dffd01 fetchmail-6.3.8-i386-1_slack9.0.tgz\n\nSlackware 9.1 package:\nd791215ee93508ab8e82a9038a7a838f fetchmail-6.3.8-i486-1_slack9.1.tgz\n\nSlackware 10.0 package:\nf30d0eadac70861cd437112f426c97e4 fetchmail-6.3.8-i486-1_slack10.0.tgz\n\nSlackware 10.1 package:\n64c4a49b7b88e67151cbf9c68b66c64a fetchmail-6.3.8-i486-1_slack10.1.tgz\n\nSlackware 10.2 package:\n507cd71d2d2fdbcce4b009eb730f12ba fetchmail-6.3.8-i486-1_slack10.2.tgz\n\nSlackware 11.0 package:\nc221a17709e63f4a61df34a02c65ff6f fetchmail-6.3.8-i486-1_slack11.0.tgz\n\nSlackware 12.0 package:\ne6f9da78a683f27bd4788d391a4d2edd fetchmail-6.3.8-i486-3_slack12.0.tgz\n\nSlackware 12.1 package:\nef59967ab69a16d6b23083691550d53d fetchmail-6.3.8-i486-3_slack12.1.tgz\n\nSlackware -current package:\n0c4c7d0a8d72ef4548bff0c60cdd516a fetchmail-6.3.8-i486-3.tgz\n\n\nInstallation instructions:\n\nUpgrade the package as root:\n > upgradepkg fetchmail-6.3.8-i486-3_slack12.1.tgz", "cvss3": {}, "published": "2008-07-29T05:31:09", "type": "slackware", "title": "[slackware-security] fetchmail", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "PARTIAL", "integrityImpact": "NONE", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2008-2711"], "modified": "2008-07-29T05:31:09", "id": "SSA-2008-210-01", "href": "http://www.slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.495740", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P"}}], "ubuntucve": [{"lastseen": "2023-06-06T14:58:34", "description": "fetchmail 6.3.8 and earlier, when running in -v -v (aka verbose) mode,\nallows remote attackers to cause a denial of service (crash and persistent\nmail failure) via a malformed mail message with long headers, which\ntriggers an erroneous dereference when using vsnprintf to format log\nmessages.\n\n#### Bugs\n\n * <https://bugs.launchpad.net/bugs/240549>\n\n\n#### Notes\n\nAuthor| Note \n---|--- \n[jdstrand](<https://launchpad.net/~jdstrand>) | per Debian, http://www.openwall.com/lists/oss-security/2008/06/13/1, -vv is only used for debugging purposes so this does not prevent a victim from getting mails. -vv is not used in non-interactive use.\n", "cvss3": {}, "published": "2008-06-16T00:00:00", "type": "ubuntucve", "title": "CVE-2008-2711", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "PARTIAL", "integrityImpact": "NONE", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2008-2711"], "modified": "2008-06-16T00:00:00", "id": "UB:CVE-2008-2711", "href": "https://ubuntu.com/security/CVE-2008-2711", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2023-06-06T15:00:12", "description": "sink.c in fetchmail before 6.3.9 allows context-dependent attackers to\ncause a denial of service (NULL dereference and application crash) by\nrefusing certain warning messages that are sent over SMTP.", "cvss3": {}, "published": "2007-08-28T00:00:00", "type": "ubuntucve", "title": "CVE-2007-4565", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "PARTIAL", "integrityImpact": "NONE", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2007-4565"], "modified": "2007-08-28T00:00:00", "id": "UB:CVE-2007-4565", "href": "https://ubuntu.com/security/CVE-2007-4565", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}], "debiancve": [{"lastseen": "2023-06-06T14:54:37", "description": "fetchmail 6.3.8 and earlier, when running in -v -v (aka verbose) mode, allows remote attackers to cause a denial of service (crash and persistent mail failure) via a malformed mail message with long headers, which triggers an erroneous dereference when using vsnprintf to format log messages.", "cvss3": {}, "published": "2008-06-16T21:41:00", "type": "debiancve", "title": "CVE-2008-2711", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "PARTIAL", "integrityImpact": "NONE", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2008-2711"], "modified": "2008-06-16T21:41:00", "id": "DEBIANCVE:CVE-2008-2711", "href": "https://security-tracker.debian.org/tracker/CVE-2008-2711", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2023-06-06T14:54:37", "description": "sink.c in fetchmail before 6.3.9 allows context-dependent attackers to cause a denial of service (NULL dereference and application crash) by refusing certain warning messages that are sent over SMTP.", "cvss3": {}, "published": "2007-08-28T01:17:00", "type": "debiancve", "title": "CVE-2007-4565", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "PARTIAL", "integrityImpact": "NONE", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2007-4565"], "modified": "2007-08-28T01:17:00", "id": "DEBIANCVE:CVE-2007-4565", "href": "https://security-tracker.debian.org/tracker/CVE-2007-4565", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}], "cve": [{"lastseen": "2023-06-07T14:12:16", "description": "fetchmail 6.3.8 and earlier, when running in -v -v (aka verbose) mode, allows remote attackers to cause a denial of service (crash and persistent mail failure) via a malformed mail message with long headers, which triggers an erroneous dereference when using vsnprintf to format log messages.", "cvss3": {}, "published": "2008-06-16T21:41:00", "type": "cve", "title": "CVE-2008-2711", "cwe": ["CWE-20"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "PARTIAL", "integrityImpact": "NONE", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2008-2711"], "modified": "2021-08-09T21:15:00", "cpe": ["cpe:/a:fetchmail:fetchmail:6.2.3", "cpe:/a:fetchmail:fetchmail:6.3.7", "cpe:/a:fetchmail:fetchmail:5.9.13", "cpe:/a:fetchmail:fetchmail:6.2.4", "cpe:/a:fetchmail:fetchmail:5.2.0", "cpe:/a:fetchmail:fetchmail:5.8.13", "cpe:/a:fetchmail:fetchmail:5.4.4", "cpe:/a:fetchmail:fetchmail:6.2.5.4", "cpe:/a:fetchmail:fetchmail:5.2.7", "cpe:/a:fetchmail:fetchmail:5.0.0", "cpe:/a:fetchmail:fetchmail:5.9.11", "cpe:/a:fetchmail:fetchmail:5.5.2", "cpe:/a:fetchmail:fetchmail:5.8.17", "cpe:/a:fetchmail:fetchmail:4.7.1", "cpe:/a:fetchmail:fetchmail:6.1.0", "cpe:/a:fetchmail:fetchmail:5.8.3", "cpe:/a:fetchmail:fetchmail:4.7.0", "cpe:/a:fetchmail:fetchmail:5.9.5", "cpe:/a:fetchmail:fetchmail:5.4.3", "cpe:/a:fetchmail:fetchmail:4.6.4", "cpe:/a:fetchmail:fetchmail:5.8.2", "cpe:/a:fetchmail:fetchmail:4.7.3", "cpe:/a:fetchmail:fetchmail:4.7.2", "cpe:/a:fetchmail:fetchmail:5.3.3", "cpe:/a:fetchmail:fetchmail:5.0.5", "cpe:/a:fetchmail:fetchmail:4.6.9", "cpe:/a:fetchmail:fetchmail:6.2.5", "cpe:/a:fetchmail:fetchmail:5.0.6", "cpe:/a:fetchmail:fetchmail:4.5.4", "cpe:/a:fetchmail:fetchmail:4.5.2", "cpe:/a:fetchmail:fetchmail:6.1.3", "cpe:/a:fetchmail:fetchmail:5.0.3", "cpe:/a:fetchmail:fetchmail:5.9.4", "cpe:/a:fetchmail:fetchmail:5.8", "cpe:/a:fetchmail:fetchmail:5.9.10", "cpe:/a:fetchmail:fetchmail:6.2.1", "cpe:/a:fetchmail:fetchmail:6.2.6", "cpe:/a:fetchmail:fetchmail:5.8.4", "cpe:/a:fetchmail:fetchmail:5.3.8", "cpe:/a:fetchmail:fetchmail:5.0.2", "cpe:/a:fetchmail:fetchmail:6.3.8", "cpe:/a:fetchmail:fetchmail:6.3.3", "cpe:/a:fetchmail:fetchmail:5.0.8", "cpe:/a:fetchmail:fetchmail:5.8.1", "cpe:/a:fetchmail:fetchmail:4.6.2", "cpe:/a:fetchmail:fetchmail:6.2.2", "cpe:/a:fetchmail:fetchmail:6.3.6", "cpe:/a:fetchmail:fetchmail:5.7.4", "cpe:/a:fetchmail:fetchmail:4.7.6", "cpe:/a:fetchmail:fetchmail:4.5.5", "cpe:/a:fetchmail:fetchmail:4.6.7", "cpe:/a:fetchmail:fetchmail:4.7.5", "cpe:/a:fetchmail:fetchmail:5.9.8", "cpe:/a:fetchmail:fetchmail:4.6.1", "cpe:/a:fetchmail:fetchmail:4.5.1", "cpe:/a:fetchmail:fetchmail:4.5.3", "cpe:/a:fetchmail:fetchmail:4.5.6", "cpe:/a:fetchmail:fetchmail:5.3.1", "cpe:/a:fetchmail:fetchmail:5.0.1", "cpe:/a:fetchmail:fetchmail:5.4.0", "cpe:/a:fetchmail:fetchmail:4.6.3", "cpe:/a:fetchmail:fetchmail:5.4.5", "cpe:/a:fetchmail:fetchmail:5.5.5", "cpe:/a:fetchmail:fetchmail:6.2.5.2", "cpe:/a:fetchmail:fetchmail:5.0.4", "cpe:/a:fetchmail:fetchmail:4.6.8", "cpe:/a:fetchmail:fetchmail:6.3.1", "cpe:/a:fetchmail:fetchmail:5.5.3", "cpe:/a:fetchmail:fetchmail:5.8.11", "cpe:/a:fetchmail:fetchmail:6.3.2", "cpe:/a:fetchmail:fetchmail:6.3.5", "cpe:/a:fetchmail:fetchmail:5.2.1", "cpe:/a:fetchmail:fetchmail:5.7.0", "cpe:/a:fetchmail:fetchmail:5.5.0", "cpe:/a:fetchmail:fetchmail:5.1.4", "cpe:/a:fetchmail:fetchmail:5.8.14", "cpe:/a:fetchmail:fetchmail:4.6.5", "cpe:/a:fetchmail:fetchmail:6.2.5.1", "cpe:/a:fetchmail:fetchmail:5.2.8", "cpe:/a:fetchmail:fetchmail:5.8.6", "cpe:/a:fetchmail:fetchmail:5.0.7", "cpe:/a:fetchmail:fetchmail:4.6.0", "cpe:/a:fetchmail:fetchmail:5.9.0", "cpe:/a:fetchmail:fetchmail:5.2.3", "cpe:/a:fetchmail:fetchmail:6.2.9", "cpe:/a:fetchmail:fetchmail:5.2.4", "cpe:/a:fetchmail:fetchmail:5.7.2", "cpe:/a:fetchmail:fetchmail:5.8.5", "cpe:/a:fetchmail:fetchmail:6.3.0", "cpe:/a:fetchmail:fetchmail:5.1.0", "cpe:/a:fetchmail:fetchmail:4.7.4", "cpe:/a:fetchmail:fetchmail:4.6.6", "cpe:/a:fetchmail:fetchmail:4.7.7", "cpe:/a:fetchmail:fetchmail:4.5.7", "cpe:/a:fetchmail:fetchmail:4.5.8", "cpe:/a:fetchmail:fetchmail:6.0.0", "cpe:/a:fetchmail:fetchmail:5.3.0", "cpe:/a:fetchmail:fetchmail:5.5.6", "cpe:/a:fetchmail:fetchmail:6.2.0", "cpe:/a:fetchmail:fetchmail:5.6.0", "cpe:/a:fetchmail:fetchmail:6.3.4"], "id": "CVE-2008-2711", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2008-2711", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:N/A:P"}, "cpe23": ["cpe:2.3:a:fetchmail:fetchmail:5.8.1:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:5.0.2:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:6.3.6:rc5:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:5.9.10:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:5.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:5.7.2:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:6.3.6:rc1:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:4.7.6:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:5.4.0:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:4.5.6:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:5.9.8:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:6.2.9:rc5:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:5.8.5:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:6.3.3:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:6.2.2:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:4.7.1:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:5.9.0:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:5.5.0:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:6.3.6:rc4:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:6.3.6:rc3:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:5.0.8:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:6.3.4:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:6.3.7:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:5.5.5:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:6.2.5.4:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:5.2.8:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:6.3.8:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:6.2.9:rc8:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:5.2.0:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:5.2.7:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:6.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:5.9.11:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:4.7.7:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:5.8:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:5.3.8:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:6.3.6:rc2:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:6.2.5:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:4.6.9:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:6.2.6:pre9:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:5.7.4:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:5.0.7:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:6.2.6:pre8:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:6.2.9:rc4:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:6.3.5:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:4.6.1:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:6.2.6:pre4:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:6.2.9:rc7:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:5.1.0:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:5.9.5:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:6.1.0:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:5.0.5:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:6.3.2:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:4.6.7:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:4.5.3:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:6.3.1:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:6.2.1:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:5.6.0:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:6.2.9:rc3:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:6.2.5.2:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:5.0.3:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:5.8.2:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:5.5.2:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:4.5.4:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:5.0.4:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:6.2.9:rc10:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:4.6.3:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:5.9.13:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:6.2.9:rc9:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:5.2.3:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:4.7.3:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:5.8.11:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:5.0.6:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:5.1.4:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:5.8.13:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:4.6.4:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:5.4.3:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:4.5.5:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:5.4.5:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:6.2.5.1:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:4.6.2:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:5.3.1:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:5.8.4:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:5.5.3:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:5.3.3:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:6.3.6:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:6.2.0:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:5.2.1:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:5.8.6:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:5.3.0:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:4.7.0:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:6.2.3:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:4.5.7:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:6.2.4:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:4.5.2:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:5.0.1:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:4.6.6:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:5.4.4:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:4.7.4:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:5.7.0:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:6.3.0:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:4.7.2:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:5.5.6:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:5.9.4:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:4.6.8:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:5.8.3:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:5.2.4:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:6.1.3:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:4.6.5:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:5.8.17:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:4.5.1:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:4.5.8:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:4.7.5:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:5.8.14:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:4.6.0:*:*:*:*:*:*:*"]}, {"lastseen": "2023-06-07T14:18:13", "description": "sink.c in fetchmail before 6.3.9 allows context-dependent attackers to cause a denial of service (NULL dereference and application crash) by refusing certain warning messages that are sent over SMTP.", "cvss3": {}, "published": "2007-08-28T01:17:00", "type": "cve", "title": "CVE-2007-4565", "cwe": ["NVD-CWE-Other"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "PARTIAL", "integrityImpact": "NONE", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2007-4565"], "modified": "2018-10-15T21:36:00", "cpe": ["cpe:/a:fetchmail:fetchmail:5.2.3", "cpe:/a:fetchmail:fetchmail:5.3.0", "cpe:/a:fetchmail:fetchmail:4.6.8", "cpe:/a:fetchmail:fetchmail:5.4.4", "cpe:/a:fetchmail:fetchmail:6.3.0", "cpe:/a:fetchmail:fetchmail:4.7.0", "cpe:/a:fetchmail:fetchmail:5.8.13", "cpe:/a:fetchmail:fetchmail:5.3.8", "cpe:/a:fetchmail:fetchmail:4.5.5", "cpe:/a:fetchmail:fetchmail:5.2.4", "cpe:/a:fetchmail:fetchmail:5.4.3", "cpe:/a:fetchmail:fetchmail:4.5.1", "cpe:/a:fetchmail:fetchmail:6.1.3", "cpe:/a:fetchmail:fetchmail:4.7.5", "cpe:/a:fetchmail:fetchmail:6.2.1", "cpe:/a:fetchmail:fetchmail:5.5.2", "cpe:/a:fetchmail:fetchmail:5.9.11", "cpe:/a:fetchmail:fetchmail:6.2.2", "cpe:/a:fetchmail:fetchmail:4.6.4", "cpe:/a:fetchmail:fetchmail:4.6.7", "cpe:/a:fetchmail:fetchmail:6.3.5", "cpe:/a:fetchmail:fetchmail:5.9.13", "cpe:/a:fetchmail:fetchmail:5.5.5", "cpe:/a:fetchmail:fetchmail:6.3.2", "cpe:/a:fetchmail:fetchmail:4.7.1", "cpe:/a:fetchmail:fetchmail:4.6.3", "cpe:/a:fetchmail:fetchmail:5.0.3", "cpe:/a:fetchmail:fetchmail:4.7.2", "cpe:/a:fetchmail:fetchmail:5.3.1", "cpe:/a:fetchmail:fetchmail:5.8.17", "cpe:/a:fetchmail:fetchmail:5.9.5", "cpe:/a:fetchmail:fetchmail:4.6.5", "cpe:/a:fetchmail:fetchmail:4.5.4", "cpe:/a:fetchmail:fetchmail:5.2.1", "cpe:/a:fetchmail:fetchmail:4.6.9", "cpe:/a:fetchmail:fetchmail:4.6.2", "cpe:/a:fetchmail:fetchmail:5.5.0", "cpe:/a:fetchmail:fetchmail:5.0.1", "cpe:/a:fetchmail:fetchmail:6.2.5.1", "cpe:/a:fetchmail:fetchmail:5.7.4", "cpe:/a:fetchmail:fetchmail:5.8", "cpe:/a:fetchmail:fetchmail:6.2.5.2", "cpe:/a:fetchmail:fetchmail:5.8.4", "cpe:/a:fetchmail:fetchmail:6.2.6", "cpe:/a:fetchmail:fetchmail:5.9.0", "cpe:/a:fetchmail:fetchmail:5.9.4", "cpe:/a:fetchmail:fetchmail:5.4.0", "cpe:/a:fetchmail:fetchmail:6.3.6", "cpe:/a:fetchmail:fetchmail:4.5.3", "cpe:/a:fetchmail:fetchmail:5.4.5", "cpe:/a:fetchmail:fetchmail:4.5.7", "cpe:/a:fetchmail:fetchmail:5.3.3", "cpe:/a:fetchmail:fetchmail:4.6.1", "cpe:/a:fetchmail:fetchmail:5.7.0", "cpe:/a:fetchmail:fetchmail:6.3.8", "cpe:/a:fetchmail:fetchmail:5.1.0", "cpe:/a:fetchmail:fetchmail:5.8.14", "cpe:/a:fetchmail:fetchmail:4.5.8", "cpe:/a:fetchmail:fetchmail:6.2.4", "cpe:/a:fetchmail:fetchmail:5.8.1", "cpe:/a:fetchmail:fetchmail:6.3.9", "cpe:/a:fetchmail:fetchmail:4.5.2", "cpe:/a:fetchmail:fetchmail:5.5.6", "cpe:/a:fetchmail:fetchmail:5.1.4", "cpe:/a:fetchmail:fetchmail:5.8.6", "cpe:/a:fetchmail:fetchmail:4.7.4", "cpe:/a:fetchmail:fetchmail:5.0.2", "cpe:/a:fetchmail:fetchmail:5.0.6", "cpe:/a:fetchmail:fetchmail:6.2.0", "cpe:/a:fetchmail:fetchmail:5.0.8", "cpe:/a:fetchmail:fetchmail:6.3.1", "cpe:/a:fetchmail:fetchmail:5.8.11", "cpe:/a:fetchmail:fetchmail:5.2.8", "cpe:/a:fetchmail:fetchmail:5.0.0", "cpe:/a:fetchmail:fetchmail:5.0.4", "cpe:/a:fetchmail:fetchmail:5.7.2", "cpe:/a:fetchmail:fetchmail:4.6.6", "cpe:/a:fetchmail:fetchmail:6.1.0", "cpe:/a:fetchmail:fetchmail:5.9.10", "cpe:/a:fetchmail:fetchmail:6.3.4", "cpe:/a:fetchmail:fetchmail:5.0.5", "cpe:/a:fetchmail:fetchmail:6.2.5", "cpe:/a:fetchmail:fetchmail:5.9.8", "cpe:/a:fetchmail:fetchmail:4.6.0", "cpe:/a:fetchmail:fetchmail:4.7.3", "cpe:/a:fetchmail:fetchmail:4.5.6", "cpe:/a:fetchmail:fetchmail:5.2.7", "cpe:/a:fetchmail:fetchmail:4.7.7", "cpe:/a:fetchmail:fetchmail:6.0.0", "cpe:/a:fetchmail:fetchmail:6.2.9", "cpe:/a:fetchmail:fetchmail:6.3.7", "cpe:/a:fetchmail:fetchmail:4.7.6", "cpe:/a:fetchmail:fetchmail:5.6.0", "cpe:/a:fetchmail:fetchmail:6.2.5.4", "cpe:/a:fetchmail:fetchmail:5.0.7", "cpe:/a:fetchmail:fetchmail:6.3.3", "cpe:/a:fetchmail:fetchmail:6.2.3", "cpe:/a:fetchmail:fetchmail:5.8.3", "cpe:/a:fetchmail:fetchmail:5.8.5", "cpe:/a:fetchmail:fetchmail:5.2.0", "cpe:/a:fetchmail:fetchmail:5.8.2", "cpe:/a:fetchmail:fetchmail:5.5.3"], "id": "CVE-2007-4565", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2007-4565", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}, "cpe23": ["cpe:2.3:a:fetchmail:fetchmail:4.6.2:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:4.6.1:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:5.3.1:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:6.3.6:rc1:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:5.8.4:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:4.7.1:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:6.3.2:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:6.2.6:pre9:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:5.9.5:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:4.6.8:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:5.4.0:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:5.7.4:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:4.6.4:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:6.2.9:rc5:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:4.5.2:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:6.3.9:rc2:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:5.1.0:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:5.5.2:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:5.0.2:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:5.9.0:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:6.3.8:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:5.5.6:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:5.7.0:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:4.6.7:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:5.3.0:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:4.7.6:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:5.3.8:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:5.2.7:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:6.2.9:rc8:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:5.8:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:4.5.7:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:6.2.4:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:5.2.3:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:4.6.6:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:4.7.2:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:5.6.0:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:6.3.6:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:6.2.5.1:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:4.5.1:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:5.2.8:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:5.0.8:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:4.7.7:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:4.6.9:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:6.3.4:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:5.4.5:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:5.8.5:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:5.9.10:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:6.3.7:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:5.4.3:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:5.5.3:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:6.2.5.2:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:6.2.5.4:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:5.8.3:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:6.2.1:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:5.0.1:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:6.3.6:rc2:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:5.5.0:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:5.2.1:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:6.1.3:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:6.3.6:rc5:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:5.0.3:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:5.2.0:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:5.3.3:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:6.2.3:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:5.9.11:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:6.2.9:rc3:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:4.5.3:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:5.8.13:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:5.8.6:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:6.3.6:rc3:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:5.8.17:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:6.2.6:pre8:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:4.5.4:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:5.1.4:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:6.2.5:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:4.7.5:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:6.3.1:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:4.7.0:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:4.6.5:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:4.7.3:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:5.9.4:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:4.7.4:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:5.7.2:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:6.2.9:rc10:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:6.2.9:rc4:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:5.8.14:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:5.8.1:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:5.0.7:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:4.5.6:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:6.2.6:pre4:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:6.3.6:rc4:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:6.2.2:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:6.2.0:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:4.6.0:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:4.5.5:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:4.5.8:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:5.9.13:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:4.6.3:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:6.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:6.1.0:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:5.0.5:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:5.8.11:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:5.9.8:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:6.3.3:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:5.4.4:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:6.3.5:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:5.8.2:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:5.2.4:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:5.5.5:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:5.0.0:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:5.0.4:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:6.2.9:rc9:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:5.0.6:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:6.3.0:*:*:*:*:*:*:*", "cpe:2.3:a:fetchmail:fetchmail:6.2.9:rc7:*:*:*:*:*:*"]}], "osv": [{"lastseen": "2022-07-21T08:35:13", "description": "\nMatthias Andree discovered that fetchmail, an SSL enabled POP3, APOP \nand IMAP mail gatherer/forwarder, can under certain circumstances \nattempt to dereference a NULL pointer and crash.\n\n\nFor the old stable distribution (sarge), this problem was not present.\n\n\nFor the stable distribution (etch), this problem has been fixed in\nversion 6.3.6-1etch1.\n\n\nFor the unstable distribution (sid), this problem will be fixed soon.\n\n\nWe recommend that you upgrade your fetchmail package.\n\n\n", "cvss3": {}, "published": "2007-09-21T00:00:00", "type": "osv", "title": "fetchmail - null pointer dereference", "bulletinFamily": "software", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "PARTIAL", "integrityImpact": "NONE", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2007-4565"], "modified": "2022-07-21T05:46:21", "id": "OSV:DSA-1377-2", "href": "https://osv.dev/vulnerability/DSA-1377-2", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}], "debian": [{"lastseen": "2023-05-02T17:27:09", "description": "- ------------------------------------------------------------------------\nDebian Security Advisory DSA-1377-2 security@debian.org\nhttp://www.debian.org/security/ Steve Kemp\nSeptember 21, 2007 http://www.debian.org/security/faq\n- ------------------------------------------------------------------------\n\nPackage : fetchmail\nVulnerability : null pointer dereference\nProblem type : remote\nDebian-specific: no\nCVE Id(s) : CVE-2007-4565\n\nMatthias Andree discovered that fetchmail, an SSL enabled POP3, APOP \nand IMAP mail gatherer/forwarder, can under certain circumstances \nattempt to dereference a NULL pointer and crash.\n\nFor the stable distribution (etch), this problem has been fixed in\nversion 6.3.6-1etch1.\n\nFor the old stable distribution (sarge), this problem was not present.\n\nFor the unstable distribution (sid), this problem will be fixed soon.\n\nWe recommend that you upgrade your fetchmail package.\n\nUpgrade instructions\n- --------------------\n\nwget url\n will fetch the file for you\ndpkg -i file.deb\n will install the referenced file.\n\nIf you are using the apt-get package manager, use the line for\nsources.list as given below:\n\napt-get update\n will update the internal database\napt-get upgrade\n will install corrected packages\n\nYou may use an automated update by adding the resources from the\nfooter to the proper configuration.\n\n\nDebian GNU/Linux 4.0 alias etch\n- -------------------------------\n\ni386 architecture (Intel ia32)\n\n http://security.debian.org/pool/updates/main/f/fetchmail/fetchmail_6.3.6-1etch1_i386.deb\n Size/MD5 checksum: 641344 2eadc43a18712b3a1763094f7c837475\n\n\n These files will probably be moved into the stable distribution on\n its next update.\n\n- ---------------------------------------------------------------------------------\nFor apt-get: deb http://security.debian.org/ stable/updates main\nFor dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main\nMailing list: debian-security-announce@lists.debian.org\nPackage info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>", "cvss3": {}, "published": "2007-09-21T16:43:46", "type": "debian", "title": "[SECURITY] [DSA 1377-2] New fetchmail packages fix denial of service", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "PARTIAL", "integrityImpact": "NONE", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2007-4565"], "modified": "2007-09-21T16:43:46", "id": "DEBIAN:DSA-1377-2:20B24", "href": "https://lists.debian.org/debian-security-announce/2007/msg00145.html", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}, {"lastseen": "2023-05-02T17:27:13", "description": "- ------------------------------------------------------------------------\nDebian Security Advisory DSA-1377 security@debian.org\nhttp://www.debian.org/security/ Steve Kemp\nSeptember 21, 2007 http://www.debian.org/security/faq\n- ------------------------------------------------------------------------\n\nPackage : fetchmail\nVulnerability : null pointer dereference\nProblem type : remote\nDebian-specific: no\nCVE Id(s) : CVE-2007-4565\n\nMatthias Andree discovered that fetchmail, an SSL enabled POP3, APOP \nand IMAP mail gatherer/forwarder, can under certain circumstances \nattempt to dereference a NULL pointer and crash.\n\nFor the stable distribution (etch), this problem has been fixed in\nversion 6.3.6-1etch1.\n\nFor the old stable distribution (sarge), this problem was not present.\n\nFor the unstable distribution (sid), this problem will be fixed soon.\n\nWe recommend that you upgrade your fetchmail package.\n\n\nUpgrade instructions\n- --------------------\n\nwget url\n will fetch the file for you\ndpkg -i file.deb\n will install the referenced file.\n\nIf you are using the apt-get package manager, use the line for\nsources.list as given below:\n\napt-get update\n will update the internal database\napt-get upgrade\n will install corrected packages\n\nYou may use an automated update by adding the resources from the\nfooter to the proper configuration.\n\n\nDebian GNU/Linux 4.0 alias etch\n- -------------------------------\n\nSource archives:\n\n http://security.debian.org/pool/updates/main/f/fetchmail/fetchmail_6.3.6-1etch1.diff.gz\n Size/MD5 checksum: 44533 19b72a3a0b2cf08f833ea21c3e18902c\n http://security.debian.org/pool/updates/main/f/fetchmail/fetchmail_6.3.6.orig.tar.gz\n Size/MD5 checksum: 1680200 04175459cdf32fdb10d9e8fc46b633c3\n http://security.debian.org/pool/updates/main/f/fetchmail/fetchmail_6.3.6-1etch1.dsc\n Size/MD5 checksum: 874 0aa3d869aba6fdfe87d1c4a626f5380e\n\nArchitecture independent packages:\n\n http://security.debian.org/pool/updates/main/f/fetchmail/fetchmailconf_6.3.6-1etch1_all.deb\n Size/MD5 checksum: 61564 f587ce05ee98694f3bd4db0fa88742f7\n\namd64 architecture (AMD x86_64 (AMD64))\n\n http://security.debian.org/pool/updates/main/f/fetchmail/fetchmail_6.3.6-1etch1_amd64.deb\n Size/MD5 checksum: 650278 b00d2237d26d9e588e6c03ad17f79a74\n\narm architecture (ARM)\n\n http://security.debian.org/pool/updates/main/f/fetchmail/fetchmail_6.3.6-1etch1_arm.deb\n Size/MD5 checksum: 645026 67e5ebf76d55cc857610d3b326784d3c\n\nhppa architecture (HP PA RISC)\n\n http://security.debian.org/pool/updates/main/f/fetchmail/fetchmail_6.3.6-1etch1_hppa.deb\n Size/MD5 checksum: 654006 58d5770e497d405c1e2f867add9d6f87\n\nia64 architecture (Intel ia64)\n\n http://security.debian.org/pool/updates/main/f/fetchmail/fetchmail_6.3.6-1etch1_ia64.deb\n Size/MD5 checksum: 700752 df4c57c97970537cb2f6a885bc03e54d\n\nmips architecture (MIPS (Big Endian))\n\n http://security.debian.org/pool/updates/main/f/fetchmail/fetchmail_6.3.6-1etch1_mips.deb\n Size/MD5 checksum: 650540 49b888adc52c5bf8d4be82c4b51d68f5\n\npowerpc architecture (PowerPC)\n\n http://security.debian.org/pool/updates/main/f/fetchmail/fetchmail_6.3.6-1etch1_powerpc.deb\n Size/MD5 checksum: 647060 a278efba96b95e15977628bd85af5c85\n\ns390 architecture (IBM S/390)\n\n http://security.debian.org/pool/updates/main/f/fetchmail/fetchmail_6.3.6-1etch1_s390.deb\n Size/MD5 checksum: 646896 e520c2c6febf1e756a75b75cbc06c723\n\nsparc architecture (Sun SPARC/UltraSPARC)\n\n http://security.debian.org/pool/updates/main/f/fetchmail/fetchmail_6.3.6-1etch1_sparc.deb\n Size/MD5 checksum: 641102 938f11eb5071c7e141c6ff8795af87e7\n\n\n These files will probably be moved into the stable distribution on\n its next update.\n\n- ---------------------------------------------------------------------------------\nFor apt-get: deb http://security.debian.org/ stable/updates main\nFor dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main\nMailing list: debian-security-announce@lists.debian.org\nPackage info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>", "cvss3": {}, "published": "2007-09-21T11:28:16", "type": "debian", "title": "[SECURITY] [DSA 1377-1] New fetchmail packages fix denial of service", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "PARTIAL", "integrityImpact": "NONE", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2007-4565"], "modified": "2007-09-21T11:28:16", "id": "DEBIAN:DSA-1377-1:F4A0B", "href": "https://lists.debian.org/debian-security-announce/2007/msg00144.html", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}], "redhatcve": [{"lastseen": "2023-06-06T15:04:57", "description": "A flaw was found in fetchmail. The flaw lies in how fetchmail when running in verbose mode using the -v flag tries to log long messages that are created from long headers. An attacker could potentially use this flaw to cause a Denial of Service attack or crash. The highest threat from this vulnerability is to data availability. This flaw was earlier identified by CVE-2008-2711 and fixed, however it recently got reintroduced due to a code refactoring issue. The current bug fix applies a different approach than the earlier one.\n", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "baseScore": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 3.6}, "published": "2021-07-29T16:20:37", "type": "redhatcve", "title": "CVE-2021-36386", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "PARTIAL", "integrityImpact": "NONE", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2008-2711", "CVE-2021-36386"], "modified": "2023-04-06T09:11:07", "id": "RH:CVE-2021-36386", "href": "https://access.redhat.com/security/cve/cve-2021-36386", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}], "ubuntu": [{"lastseen": "2023-06-06T16:24:04", "description": "## Releases\n\n * Ubuntu 7.04 \n * Ubuntu 6.10 \n * Ubuntu 6.06 \n\n## Packages\n\n * fetchmail \\- \n\nGaetan Leurent discovered a vulnerability in the APOP protocol based \non MD5 collisions. As fetchmail supports the APOP protocol, this \nvulnerability can be used by attackers to discover a portion of the APOP \nuser's authentication credentials. (CVE-2007-1558)\n\nEarl Chew discovered that fetchmail can be made to de-reference a NULL \npointer when contacting SMTP servers. This vulnerability can be used \nby attackers who control the SMTP server to crash fetchmail and cause \na denial of service. (CVE-2007-4565)\n", "cvss3": {}, "published": "2007-09-26T00:00:00", "type": "ubuntu", "title": "fetchmail vulnerabilities", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "PARTIAL", "integrityImpact": "NONE", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2007-1558", "CVE-2007-4565"], "modified": "2007-09-26T00:00:00", "id": "USN-520-1", "href": "https://ubuntu.com/security/notices/USN-520-1", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:N/A:P"}}]}
fetchmail multiple security vulnerabilities
