Test ID:	1.3.6.1.4.1.25623.1.0.53455
Category:	Debian Local Security Checks
Title:	Debian: Security Advisory (DSA-216)
Summary:	The remote host is missing an update for the Debian 'fetchmail' package(s) announced via the DSA-216 advisory.
Description:	Summary: The remote host is missing an update for the Debian 'fetchmail' package(s) announced via the DSA-216 advisory. Vulnerability Insight: Stefan Esser of e-matters discovered a buffer overflow in fetchmail, an SSL enabled POP3, APOP and IMAP mail gatherer/forwarder. When fetchmail retrieves a mail all headers that contain addresses are searched for local addresses. If a hostname is missing, fetchmail appends it but doesn't reserve enough space for it. This heap overflow can be used by remote attackers to crash it or to execute arbitrary code with the privileges of the user running fetchmail. For the current stable distribution (woody) this problem has been fixed in version 5.9.11-6.2 of fetchmail and fetchmail-ssl. For the old stable distribution (potato) this problem has been fixed in version 5.3.3-4.3. For the unstable distribution (sid) this problem has been fixed in version 6.2.0-1 of fetchmail and fetchmail-ssl. We recommend that you upgrade your fetchmail packages. Affected Software/OS: 'fetchmail' package(s) on Debian 3.0. Solution: Please install the updated package(s). CVSS Score: 7.5 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2002-1365 BugTraq ID: 6390 http://www.securityfocus.com/bid/6390 Bugtraq: 20021213 Advisory 05/2002: Another Fetchmail Remote Vulnerability (Google Search) http://marc.info/?l=bugtraq&m=103979751818638&w=2 Bugtraq: 20021215 GLSA: fetchmail (Google Search) http://marc.info/?l=bugtraq&m=104004858802000&w=2 Caldera Security Advisory: CSSA-2003-001.0 ftp://ftp.caldera.com/pub/security/OpenLinux/CSSA-2003-001.0.txt Conectiva Linux advisory: CLA-2002:554 http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000554 Debian Security Information: DSA-216 (Google Search) http://www.debian.org/security/2002/dsa-216 En Garde Linux Advisory: ESA-20030127-002 Immunix Linux Advisory: IMNX-2003-7+-023-01 http://www.mandrakesoft.com/security/advisories?name=MDKSA-2003:011 http://security.e-matters.de/advisories/052002.html http://www.redhat.com/support/errata/RHSA-2002-293.html http://www.redhat.com/support/errata/RHSA-2002-294.html http://www.redhat.com/support/errata/RHSA-2003-155.html SuSE Security Announcement: SuSE-SA:2003:001 (Google Search) XForce ISS Database: fetchmail-address-header-bo(10839) https://exchange.xforce.ibmcloud.com/vulnerabilities/10839
Copyright	Copyright (C) 2008 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.