English | Deutsch | Español | Português
 UserID:
 Passwd:
new user
 About:   Dedicated  | Advanced  | Standard  | Recurring  | No Risk  | Desktop  | Basic  | Single  | Security Seal  | FAQ
  Price/Feature Summary  | Order  | New Vulnerabilities  | Confidentiality  | Vulnerability Search
 Vulnerability   
Search   
    Search 147413 CVE descriptions
and 71685 test descriptions,
access 10,000+ cross references.
Tests   CVE   All  

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory                           GLSA 200403-10
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                                             http://security.gentoo.org
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

  Severity: Normal
     Title: Fetchmail 6.2.5 fixes a remote DoS
      Date: March 30, 2004
      Bugs: #37717
        ID: 200403-10

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
========

Fetchmail versions 6.2.4 and earlier can be crashed by sending a
specially-crafted email to a fetchmail user.

Background
==========

Fetchmail is a utility that retrieves and forwards mail from remote
systems using IMAP, POP, and other protocols.

Affected packages
=================

    -------------------------------------------------------------------
     Package             /   Vulnerable   /                 Unaffected
    -------------------------------------------------------------------
     net-mail/fetchmail       <= 6.2.4                        >= 6.2.5

Description
===========

Fetchmail versions 6.2.4 and earlier can be crashed by sending a
specially-crafted email to a fetchmail user. This problem occurs
because Fetchmail does not properly allocate memory for long lines in
an incoming email.

Impact
======

Fetchmail users who receive a malicious email may have their fetchmail
program crash.

Workaround
==========

While a workaround is not currently known for this issue, all users are
advised to upgrade to the latest version of the affected package.

Resolution
==========

Fetchmail users should upgrade to version 6.2.5 or later:

    # emerge sync
    # emerge -pv ">=net-mail/fetchmail-6.2.5"
    # emerge ">=net-mail/fetchmail-6.2.5"

References
==========

  [ 1 ] http://xforce.iss.net/xforce/xfdb/13450
  [ 2 ] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0792

Concerns?
=========

Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
http://bugs.gentoo.org.

--

New User Registration
Email:
UserID:
Passwd:
Please email me your monthly newsletters, informing the latest services, improvements & surveys.
Please email me a vulnerability test announcement whenever a new test is added.
   Privacy
Registered User Login
 
UserID:   
Passwd:  

 Forgot userid or passwd?
Email/Userid:




Home | About Us | Contact Us | Partner Programs | Developer APIs | Privacy | Mailing Lists | Abuse
Security Audits | Managed DNS | Network Monitoring | Site Analyzer | Internet Research Reports
Web Probe

© 1998-2019 E-Soft Inc. All rights reserved.