LinuxSecurity.com
Share your story
The central voice for Linux and Open Source security news
Home News Topics Advisories HOWTOs Features Newsletters About Register

Welcome!
Sign up!
EnGarde Community
Login
Polls
What is the most important Linux security technology?
 
Advisories
Community
Linux Events
Linux User Groups
Link to Us
Security Center
Book Reviews
Security Dictionary
Security Tips
SELinux
White Papers
Featured Blogs
All About Linux
DanWalsh LiveJournal
Securitydistro
Latest Newsletters
Linux Advisory Watch: September 19th, 2014
Linux Security Week: September 15th, 2014
Subscribe
LinuxSecurity Newsletters
E-mail:
Choose Lists:
About our Newsletters
RSS Feeds
Get the LinuxSecurity news you want faster with RSS
Powered By

  
Mandriva: Updated fetchmail packages fix potential APOP vulnerabilities Print E-mail
User Rating:      How can I rate this item?
Posted by Benjamin D. Thomas   
Mandrake The APOP functionality in fetchmail's POP3 client implementation was validating the APOP challenge too lightly, accepting random garbage as a POP3 server's APOP challenge, rather than insisting it conform to RFC-822 specifications. Updated packages have been patched to prevent these issues, however it should be noted that the APOP MD5-based authentication scheme should no longer be considered secure.
 _______________________________________________________________________
 
 Mandriva Linux Security Advisory                         MDKSA-2007:105
 http://www.mandriva.com/security/
 _______________________________________________________________________
 
 Package : fetchmail
 Date    : May 17, 2007
 Affected: 2007.0, 2007.1, Corporate 3.0, Corporate 4.0
 _______________________________________________________________________
 
 Problem Description:
 
 The APOP functionality in fetchmail's POP3 client implementation was
 validating the APOP challenge too lightly, accepting random garbage
 as a POP3 server's APOP challenge, rather than insisting it conform
 to RFC-822 specifications.
 
 As a result of this flaw, it made man-in-the-middle attacks easier than
 necessary to retrieve the first few characters of the APOP secret,
 allowing them to potentially brute force the remaining characters
 easier than should be possible.
 
 Updated packages have been patched to prevent these issues, however it
 should be noted that the APOP MD5-based authentication scheme should
 no longer be considered secure.
 _______________________________________________________________________

 References:
 
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-1558
 http://www.fetchmail.info/fetchmail-SA-2007-01.txt
 _______________________________________________________________________
 
 Updated Packages:
 
 Mandriva Linux 2007.0:
 c2ac4014b50aa7ca037eb513a22ef02f  2007.0/i586/fetchmail-6.3.4-3.2mdv2007.0.i586.rpm
 c199ee31b527efd3175d7ed1e7839901  2007.0/i586/fetchmail-daemon-6.3.4-3.2mdv2007.0.i586.rpm
 f3b508c9c0da1153129c915ac4f1fc02  2007.0/i586/fetchmailconf-6.3.4-3.2mdv2007.0.i586.rpm 
 1a9051dcf0dde7cdacd5e9f322cc3b5c  2007.0/SRPMS/fetchmail-6.3.4-3.2mdv2007.0.src.rpm

 Mandriva Linux 2007.0/X86_64:
 7226a9c8d3ce66fc011b91433bfc8803  2007.0/x86_64/fetchmail-6.3.4-3.2mdv2007.0.x86_64.rpm
 4a7d05a3a4148d00d91614b1536c9871  2007.0/x86_64/fetchmail-daemon-6.3.4-3.2mdv2007.0.x86_64.rpm
 f9c2b0ae0a4390742d371f05c3fe7ec3  2007.0/x86_64/fetchmailconf-6.3.4-3.2mdv2007.0.x86_64.rpm 
 1a9051dcf0dde7cdacd5e9f322cc3b5c  2007.0/SRPMS/fetchmail-6.3.4-3.2mdv2007.0.src.rpm

 Mandriva Linux 2007.1:
 d462eecd17cf6ae0b6d6647d33f2d585  2007.1/i586/fetchmail-6.3.6-1.1mdv2007.1.i586.rpm
 9d575e6618f47924b9e8c01f650e1829  2007.1/i586/fetchmail-daemon-6.3.6-1.1mdv2007.1.i586.rpm
 40b2e12dabe589d0daef1524f29bfbcf  2007.1/i586/fetchmailconf-6.3.6-1.1mdv2007.1.i586.rpm 
 4c34025ce19a4527150ffbae18e2f310  2007.1/SRPMS/fetchmail-6.3.6-1.1mdv2007.1.src.rpm

 Mandriva Linux 2007.1/X86_64:
 14fa8c254251a4aa3b1d0a5925fc18d4  2007.1/x86_64/fetchmail-6.3.6-1.1mdv2007.1.x86_64.rpm
 b96d1020981b2f778cdd9c69f20b8421  2007.1/x86_64/fetchmail-daemon-6.3.6-1.1mdv2007.1.x86_64.rpm
 a2d2ed808460d970bf2f3eeb7dd69336  2007.1/x86_64/fetchmailconf-6.3.6-1.1mdv2007.1.x86_64.rpm 
 4c34025ce19a4527150ffbae18e2f310  2007.1/SRPMS/fetchmail-6.3.6-1.1mdv2007.1.src.rpm

 Corporate 3.0:
 6f317ee0374b4a932e419f16cc217cd3  corporate/3.0/i586/fetchmail-6.2.5-3.5.C30mdk.i586.rpm
 76bd1c16d25316642b06cef0a731361c  corporate/3.0/i586/fetchmail-daemon-6.2.5-3.5.C30mdk.i586.rpm
 b8be2f61aafaba91cecc261fa0f39f3f  corporate/3.0/i586/fetchmailconf-6.2.5-3.5.C30mdk.i586.rpm 
 6ecd14b3000639124b09715267449b10  corporate/3.0/SRPMS/fetchmail-6.2.5-3.5.C30mdk.src.rpm

 Corporate 3.0/X86_64:
 ab17fb41441c61eddd678b285e4c65ca  corporate/3.0/x86_64/fetchmail-6.2.5-3.5.C30mdk.x86_64.rpm
 493179e57b94b1167576b4ba81f53e4f  corporate/3.0/x86_64/fetchmail-daemon-6.2.5-3.5.C30mdk.x86_64.rpm
 1d08906af873ad1023947558027e25c7  corporate/3.0/x86_64/fetchmailconf-6.2.5-3.5.C30mdk.x86_64.rpm 
 6ecd14b3000639124b09715267449b10  corporate/3.0/SRPMS/fetchmail-6.2.5-3.5.C30mdk.src.rpm

 Corporate 4.0:
 4dcceb3f61790ea207d25a4bcd5d6b5c  corporate/4.0/i586/fetchmail-6.2.5-11.4.20060mlcs4.i586.rpm
 cc5d060a877c61ce2bf15e9fa4a51694  corporate/4.0/i586/fetchmail-daemon-6.2.5-11.4.20060mlcs4.i586.rpm
 2341bb3e1c08c2c43adcfccebb14b4bc  corporate/4.0/i586/fetchmailconf-6.2.5-11.4.20060mlcs4.i586.rpm 
 3cb2cd26ed758afcda29bd7ee95d8f1b  corporate/4.0/SRPMS/fetchmail-6.2.5-11.4.20060mlcs4.src.rpm

 Corporate 4.0/X86_64:
 dcf89b5f7423dd135b18bcd2bb91e9b4  corporate/4.0/x86_64/fetchmail-6.2.5-11.4.20060mlcs4.x86_64.rpm
 61a5262f41f1b92cf9ac8e57389f4097  corporate/4.0/x86_64/fetchmail-daemon-6.2.5-11.4.20060mlcs4.x86_64.rpm
 1f22ad5a19a85edc0d0f1e89a4b25e77  corporate/4.0/x86_64/fetchmailconf-6.2.5-11.4.20060mlcs4.x86_64.rpm 
 3cb2cd26ed758afcda29bd7ee95d8f1b  corporate/4.0/SRPMS/fetchmail-6.2.5-11.4.20060mlcs4.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrivaUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandriva for security.  You can obtain the
 GPG public key of the Mandriva Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandriva Linux at:

  http://www.mandriva.com/security/advisories

 If you want to report vulnerabilities, please contact

  security_(at)_mandriva.com
 _______________________________________________________________________

 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Mandriva Security Team
  
 
< Prev   Next >
    
Partner

 

Latest Features
Peter Smith Releases Linux Network Security Online
Securing a Linux Web Server
Password guessing with Medusa 2.0
Password guessing as an attack vector
Squid and Digest Authentication
Squid and Basic Authentication
Demystifying the Chinese Hacking Industry: Earning 6 Million a Night
Free Online security course (LearnSIA) - A Call for Help
What You Need to Know About Linux Rootkits
Review: A Practical Guide to Fedora and Red Hat Enterprise Linux - Fifth Edition
Yesterday's Edition
Partner Sponsor

Community | HOWTOs | Blogs | Features | Book Reviews | Networking
 Security Projects |  Latest News |  Newsletters |  SELinux |  Privacy |  Home
 Hardening |   About Us |   Advertise |   Legal Notice |   RSS |   Guardian Digital
(c)Copyright 2014 Guardian Digital, Inc. All rights reserved.