LinuxSecurity.com
Share your story
The central voice for Linux and Open Source security news
Home News Topics Advisories HOWTOs Features Newsletters About Register

Welcome!
Sign up!
EnGarde Community
Login
Polls
What is the most important Linux security technology?
 
Advisories
Community
Linux Events
Linux User Groups
Link to Us
Security Center
Book Reviews
Security Dictionary
Security Tips
SELinux
White Papers
Featured Blogs
All About Linux
DanWalsh LiveJournal
Securitydistro
Latest Newsletters
Linux Security Week: October 20th, 2014
Linux Advisory Watch: October 17th, 2014
Subscribe
LinuxSecurity Newsletters
E-mail:
Choose Lists:
About our Newsletters
RSS Feeds
Get the LinuxSecurity news you want faster with RSS
Powered By

  
RedHat: Moderate: fetchmail security update Print E-mail
User Rating:      How can I rate this item?
Posted by Benjamin D. Thomas   
RedHat Linux Updated fetchmail packages that fix two security issues are now available. This update has been rated as having moderate security impact by the Red Hat Security Response Team.
- ---------------------------------------------------------------------
                   Red Hat Security Advisory

Synopsis:          Moderate: fetchmail security update
Advisory ID:       RHSA-2007:0018-01
Advisory URL:      https://rhn.redhat.com/errata/RHSA-2007-0018.html
Issue date:        2007-01-31
Updated on:        2007-01-31
Product:           Red Hat Enterprise Linux
Keywords:          multidrop TLS POP3
CVE Names:         CVE-2005-4348 CVE-2006-5867 
- ---------------------------------------------------------------------

1. Summary:

Updated fetchmail packages that fix two security issues are now available.

This update has been rated as having moderate security impact by the Red
Hat Security Response Team.

2. Relevant releases/architectures:

Red Hat Enterprise Linux AS (Advanced Server) version 2.1 - i386, ia64
Red Hat Linux Advanced Workstation 2.1 - ia64
Red Hat Enterprise Linux ES version 2.1 - i386
Red Hat Enterprise Linux WS version 2.1 - i386
Red Hat Enterprise Linux AS version 3 - i386, ia64, ppc, s390, s390x, x86_64
Red Hat Desktop version 3 - i386, x86_64
Red Hat Enterprise Linux ES version 3 - i386, ia64, x86_64
Red Hat Enterprise Linux WS version 3 - i386, ia64, x86_64
Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, s390, s390x, x86_64
Red Hat Enterprise Linux Desktop version 4 - i386, x86_64
Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64
Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64

3. Problem description:

Fetchmail is a remote mail retrieval and forwarding utility.

A denial of service flaw was found when Fetchmail was run in multidrop
mode.  A malicious mail server could send a message without headers which
would cause Fetchmail to crash (CVE-2005-4348).  This issue did not affect
the version of Fetchmail shipped with Red Hat Enterprise Linux 2.1 or 3.

A flaw was found in the way Fetchmail used TLS encryption to connect to
remote hosts.  Fetchmail provided no way to enforce the use of TLS
encryption and would not authenticate POP3 protocol connections properly
(CVE-2006-5867).  This update corrects this issue by enforcing TLS
encryption when the "sslproto" configuration directive is set to "tls1".  

Users of Fetchmail should update to these packages, which contain 
backported patches to correct these issues.

Note: This update may break configurations which assumed that Fetchmail
would use plain-text authentication if TLS encryption is not supported by
the POP3 server even if the "sslproto" directive is set to "tls1".  If you
are using a custom configuration that depended on this behavior you will
need to modify your configuration appropriately after installing this update.

4. Solution:

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via Red Hat Network.  To use Red Hat Network,
launch the Red Hat Update Agent with the following command:

up2date

This will start an interactive process that will result in the appropriate
RPMs being upgraded on your system.

5. Bug IDs fixed (http://bugzilla.redhat.com/):

176266 - CVE-2005-4348 Fetchmail DOS by malicious server in multidrop mode
221981 - CVE-2006-5867 fetchmail not enforcing TLS for POP3 properly

6. RPMs required:

Red Hat Enterprise Linux AS (Advanced Server) version 2.1:

SRPMS:
ftp://updates.redhat.com/enterprise/2.1AS/en/os/SRPMS/fetchmail-5.9.0-21.7.3.el2.1.4.src.rpm
fab2904aa98dfe5fe2eb75f6102b3732  fetchmail-5.9.0-21.7.3.el2.1.4.src.rpm

i386:
e31563e2dfc8c932217bd1c7f7b1240b  fetchmail-5.9.0-21.7.3.el2.1.4.i386.rpm
9a97eff50a8354245833c2a49e18ceda  fetchmailconf-5.9.0-21.7.3.el2.1.4.i386.rpm

ia64:
c05a0909788b58915df9ba7123291719  fetchmail-5.9.0-21.7.3.el2.1.4.ia64.rpm
1c014f448b74cfec7b8ba41f6eca0b0c  fetchmailconf-5.9.0-21.7.3.el2.1.4.ia64.rpm

Red Hat Linux Advanced Workstation 2.1:

SRPMS:
ftp://updates.redhat.com/enterprise/2.1AW/en/os/SRPMS/fetchmail-5.9.0-21.7.3.el2.1.4.src.rpm
fab2904aa98dfe5fe2eb75f6102b3732  fetchmail-5.9.0-21.7.3.el2.1.4.src.rpm

ia64:
c05a0909788b58915df9ba7123291719  fetchmail-5.9.0-21.7.3.el2.1.4.ia64.rpm
1c014f448b74cfec7b8ba41f6eca0b0c  fetchmailconf-5.9.0-21.7.3.el2.1.4.ia64.rpm

Red Hat Enterprise Linux ES version 2.1:

SRPMS:
ftp://updates.redhat.com/enterprise/2.1ES/en/os/SRPMS/fetchmail-5.9.0-21.7.3.el2.1.4.src.rpm
fab2904aa98dfe5fe2eb75f6102b3732  fetchmail-5.9.0-21.7.3.el2.1.4.src.rpm

i386:
e31563e2dfc8c932217bd1c7f7b1240b  fetchmail-5.9.0-21.7.3.el2.1.4.i386.rpm
9a97eff50a8354245833c2a49e18ceda  fetchmailconf-5.9.0-21.7.3.el2.1.4.i386.rpm

Red Hat Enterprise Linux WS version 2.1:

SRPMS:
ftp://updates.redhat.com/enterprise/2.1WS/en/os/SRPMS/fetchmail-5.9.0-21.7.3.el2.1.4.src.rpm
fab2904aa98dfe5fe2eb75f6102b3732  fetchmail-5.9.0-21.7.3.el2.1.4.src.rpm

i386:
e31563e2dfc8c932217bd1c7f7b1240b  fetchmail-5.9.0-21.7.3.el2.1.4.i386.rpm
9a97eff50a8354245833c2a49e18ceda  fetchmailconf-5.9.0-21.7.3.el2.1.4.i386.rpm

Red Hat Enterprise Linux AS version 3:

SRPMS:
ftp://updates.redhat.com/enterprise/3AS/en/os/SRPMS/fetchmail-6.2.0-3.el3.3.src.rpm
786e014898c168c69f44da351ca0522b  fetchmail-6.2.0-3.el3.3.src.rpm

i386:
d35be6f0a4f0e4b9a2fcdd134bf5da53  fetchmail-6.2.0-3.el3.3.i386.rpm
a510ee49f4ca088b480d7762085f3e8d  fetchmail-debuginfo-6.2.0-3.el3.3.i386.rpm

ia64:
eb95e7909232fcc77c4ecf6ebd260580  fetchmail-6.2.0-3.el3.3.ia64.rpm
577cbd3f17e1ac11ebbf585fe7050881  fetchmail-debuginfo-6.2.0-3.el3.3.ia64.rpm

ppc:
057e6c3f061f3a745d9c53e182d152cb  fetchmail-6.2.0-3.el3.3.ppc.rpm
7701074d387923319b195cc3e368b960  fetchmail-debuginfo-6.2.0-3.el3.3.ppc.rpm

s390:
ccd9e8d06484c8a7ac748dfa46c0b8f2  fetchmail-6.2.0-3.el3.3.s390.rpm
7657fa6b53b1107a18aa7869ec771bd7  fetchmail-debuginfo-6.2.0-3.el3.3.s390.rpm

s390x:
7974a79684df3749e326b5a96b054616  fetchmail-6.2.0-3.el3.3.s390x.rpm
e7eaf5ae18697113bd81961c4a3e55a1  fetchmail-debuginfo-6.2.0-3.el3.3.s390x.rpm

x86_64:
d4ac2065f887e9ae72dda8aeedd697e7  fetchmail-6.2.0-3.el3.3.x86_64.rpm
81354d8098561020166e6cc0ed3a9d8e  fetchmail-debuginfo-6.2.0-3.el3.3.x86_64.rpm

Red Hat Desktop version 3:

SRPMS:
ftp://updates.redhat.com/enterprise/3desktop/en/os/SRPMS/fetchmail-6.2.0-3.el3.3.src.rpm
786e014898c168c69f44da351ca0522b  fetchmail-6.2.0-3.el3.3.src.rpm

i386:
d35be6f0a4f0e4b9a2fcdd134bf5da53  fetchmail-6.2.0-3.el3.3.i386.rpm
a510ee49f4ca088b480d7762085f3e8d  fetchmail-debuginfo-6.2.0-3.el3.3.i386.rpm

x86_64:
d4ac2065f887e9ae72dda8aeedd697e7  fetchmail-6.2.0-3.el3.3.x86_64.rpm
81354d8098561020166e6cc0ed3a9d8e  fetchmail-debuginfo-6.2.0-3.el3.3.x86_64.rpm

Red Hat Enterprise Linux ES version 3:

SRPMS:
ftp://updates.redhat.com/enterprise/3ES/en/os/SRPMS/fetchmail-6.2.0-3.el3.3.src.rpm
786e014898c168c69f44da351ca0522b  fetchmail-6.2.0-3.el3.3.src.rpm

i386:
d35be6f0a4f0e4b9a2fcdd134bf5da53  fetchmail-6.2.0-3.el3.3.i386.rpm
a510ee49f4ca088b480d7762085f3e8d  fetchmail-debuginfo-6.2.0-3.el3.3.i386.rpm

ia64:
eb95e7909232fcc77c4ecf6ebd260580  fetchmail-6.2.0-3.el3.3.ia64.rpm
577cbd3f17e1ac11ebbf585fe7050881  fetchmail-debuginfo-6.2.0-3.el3.3.ia64.rpm

x86_64:
d4ac2065f887e9ae72dda8aeedd697e7  fetchmail-6.2.0-3.el3.3.x86_64.rpm
81354d8098561020166e6cc0ed3a9d8e  fetchmail-debuginfo-6.2.0-3.el3.3.x86_64.rpm

Red Hat Enterprise Linux WS version 3:

SRPMS:
ftp://updates.redhat.com/enterprise/3WS/en/os/SRPMS/fetchmail-6.2.0-3.el3.3.src.rpm
786e014898c168c69f44da351ca0522b  fetchmail-6.2.0-3.el3.3.src.rpm

i386:
d35be6f0a4f0e4b9a2fcdd134bf5da53  fetchmail-6.2.0-3.el3.3.i386.rpm
a510ee49f4ca088b480d7762085f3e8d  fetchmail-debuginfo-6.2.0-3.el3.3.i386.rpm

ia64:
eb95e7909232fcc77c4ecf6ebd260580  fetchmail-6.2.0-3.el3.3.ia64.rpm
577cbd3f17e1ac11ebbf585fe7050881  fetchmail-debuginfo-6.2.0-3.el3.3.ia64.rpm

x86_64:
d4ac2065f887e9ae72dda8aeedd697e7  fetchmail-6.2.0-3.el3.3.x86_64.rpm
81354d8098561020166e6cc0ed3a9d8e  fetchmail-debuginfo-6.2.0-3.el3.3.x86_64.rpm

Red Hat Enterprise Linux AS version 4:

SRPMS:
ftp://updates.redhat.com/enterprise/4AS/en/os/SRPMS/fetchmail-6.2.5-6.el4.5.src.rpm
3c4f4b1ddbb6ce8ffc4d725e17acc9a7  fetchmail-6.2.5-6.el4.5.src.rpm

i386:
3e2ab1a0a90e68e25290e834b9b3fc30  fetchmail-6.2.5-6.el4.5.i386.rpm
85d86e137158281b3e59ad77bdef489c  fetchmail-debuginfo-6.2.5-6.el4.5.i386.rpm

ia64:
ccc7ed6a3de49200aa3c86dd1919bb0a  fetchmail-6.2.5-6.el4.5.ia64.rpm
75ad1e0cc2c6d72baa0ea9e9122c2501  fetchmail-debuginfo-6.2.5-6.el4.5.ia64.rpm

ppc:
9b781df3ade717d6276af0c922a13b22  fetchmail-6.2.5-6.el4.5.ppc.rpm
8a12686eb7df7a4cd789bc1e371d8441  fetchmail-debuginfo-6.2.5-6.el4.5.ppc.rpm

s390:
62dcc2fed3115cafaedff2db94e35377  fetchmail-6.2.5-6.el4.5.s390.rpm
dc72a4bc097f2c3fb614b987fb618b52  fetchmail-debuginfo-6.2.5-6.el4.5.s390.rpm

s390x:
1e8b28798ad17fd9d498cfbd5e8f5820  fetchmail-6.2.5-6.el4.5.s390x.rpm
dd46c126b674008eb8ed9f91e419c045  fetchmail-debuginfo-6.2.5-6.el4.5.s390x.rpm

x86_64:
806adc07ed6a1ec9a3e24f59e9e143c9  fetchmail-6.2.5-6.el4.5.x86_64.rpm
89821346e8d9cf156a46ac53fbf8142e  fetchmail-debuginfo-6.2.5-6.el4.5.x86_64.rpm

Red Hat Enterprise Linux Desktop version 4:

SRPMS:
ftp://updates.redhat.com/enterprise/4Desktop/en/os/SRPMS/fetchmail-6.2.5-6.el4.5.src.rpm
3c4f4b1ddbb6ce8ffc4d725e17acc9a7  fetchmail-6.2.5-6.el4.5.src.rpm

i386:
3e2ab1a0a90e68e25290e834b9b3fc30  fetchmail-6.2.5-6.el4.5.i386.rpm
85d86e137158281b3e59ad77bdef489c  fetchmail-debuginfo-6.2.5-6.el4.5.i386.rpm

x86_64:
806adc07ed6a1ec9a3e24f59e9e143c9  fetchmail-6.2.5-6.el4.5.x86_64.rpm
89821346e8d9cf156a46ac53fbf8142e  fetchmail-debuginfo-6.2.5-6.el4.5.x86_64.rpm

Red Hat Enterprise Linux ES version 4:

SRPMS:
ftp://updates.redhat.com/enterprise/4ES/en/os/SRPMS/fetchmail-6.2.5-6.el4.5.src.rpm
3c4f4b1ddbb6ce8ffc4d725e17acc9a7  fetchmail-6.2.5-6.el4.5.src.rpm

i386:
3e2ab1a0a90e68e25290e834b9b3fc30  fetchmail-6.2.5-6.el4.5.i386.rpm
85d86e137158281b3e59ad77bdef489c  fetchmail-debuginfo-6.2.5-6.el4.5.i386.rpm

ia64:
ccc7ed6a3de49200aa3c86dd1919bb0a  fetchmail-6.2.5-6.el4.5.ia64.rpm
75ad1e0cc2c6d72baa0ea9e9122c2501  fetchmail-debuginfo-6.2.5-6.el4.5.ia64.rpm

x86_64:
806adc07ed6a1ec9a3e24f59e9e143c9  fetchmail-6.2.5-6.el4.5.x86_64.rpm
89821346e8d9cf156a46ac53fbf8142e  fetchmail-debuginfo-6.2.5-6.el4.5.x86_64.rpm

Red Hat Enterprise Linux WS version 4:

SRPMS:
ftp://updates.redhat.com/enterprise/4WS/en/os/SRPMS/fetchmail-6.2.5-6.el4.5.src.rpm
3c4f4b1ddbb6ce8ffc4d725e17acc9a7  fetchmail-6.2.5-6.el4.5.src.rpm

i386:
3e2ab1a0a90e68e25290e834b9b3fc30  fetchmail-6.2.5-6.el4.5.i386.rpm
85d86e137158281b3e59ad77bdef489c  fetchmail-debuginfo-6.2.5-6.el4.5.i386.rpm

ia64:
ccc7ed6a3de49200aa3c86dd1919bb0a  fetchmail-6.2.5-6.el4.5.ia64.rpm
75ad1e0cc2c6d72baa0ea9e9122c2501  fetchmail-debuginfo-6.2.5-6.el4.5.ia64.rpm

x86_64:
806adc07ed6a1ec9a3e24f59e9e143c9  fetchmail-6.2.5-6.el4.5.x86_64.rpm
89821346e8d9cf156a46ac53fbf8142e  fetchmail-debuginfo-6.2.5-6.el4.5.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and 
details on how to verify the signature are available from
https://www.redhat.com/security/team/key/#package

7. References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-4348
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5867
http://fetchmail.berlios.de/fetchmail-SA-2005-03.txt
http://fetchmail.berlios.de/fetchmail-SA-2006-03.txt
http://www.redhat.com/security/updates/classification/#moderate

8. Contact:

The Red Hat security contact is .  More contact
details at https://www.redhat.com/security/team/contact/

Copyright 2007 Red Hat, Inc.
 
< Prev   Next >
    
Partner

 

Latest Features
Peter Smith Releases Linux Network Security Online
Securing a Linux Web Server
Password guessing with Medusa 2.0
Password guessing as an attack vector
Squid and Digest Authentication
Squid and Basic Authentication
Demystifying the Chinese Hacking Industry: Earning 6 Million a Night
Free Online security course (LearnSIA) - A Call for Help
What You Need to Know About Linux Rootkits
Review: A Practical Guide to Fedora and Red Hat Enterprise Linux - Fifth Edition
Yesterday's Edition
USB is now UEC (use with extreme caution)
iPhone Encryption and the Return of the Crypto Wars
Partner Sponsor

Community | HOWTOs | Blogs | Features | Book Reviews | Networking
 Security Projects |  Latest News |  Newsletters |  SELinux |  Privacy |  Home
 Hardening |   About Us |   Advertise |   Legal Notice |   RSS |   Guardian Digital
(c)Copyright 2014 Guardian Digital, Inc. All rights reserved.