Test ID:	1.3.6.1.4.1.25623.1.0.56710
Category:	Fedora Local Security Checks
Title:	Fedora Legacy Security Advisory FLSA-2006:164512
Summary:	NOSUMMARY
Description:	Description: The remote host is missing updates announced in advisory FLSA-2006:164512. A bug was found in the way fetchmail allocates memory for long lines. A remote attacker could cause a denial of service by sending a specially- crafted email. The Common Vulnerabilities and Exposures project has assigned the name CVE-2003-0792 to this issue. A buffer overflow was discovered in fetchmail's POP3 client. A malicious server could cause send a carefully crafted message UID and cause fetchmail to crash or potentially execute arbitrary code as the user running fetchmail. The Common Vulnerabilities and Exposures project assigned the name CVE-2005-2335 to this issue. A bug was found in the way the fetchmailconf utility program writes configuration files. The default behavior of fetchmailconf is to write a configuration file which may be world readable for a short period of time. This configuration file could provide passwords to a local malicious attacker within the short window before fetchmailconf sets secure permissions. The Common Vulnerabilities and Exposures project has assigned the name CVE-2005-3088 to this issue. A bug was found when fetchmail is running in multidrop mode. A malicious mail server can cause a denial of service by sending a message without headers. The Common Vulnerabilities and Exposures project has assigned the name CVE-2005-4348 to this issue. Users of fetchmail should update to this erratum package which contains backported patches to correct these issues. Affected platforms: Redhat 7.3 Redhat 9 Fedora Core 1 Fedora Core 2 Solution: http://www.securityspace.com/smysecure/catid.html?in=FLSA-2006:164512 Risk factor : High CVSS Score: 7.8
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2003-0792 BugTraq ID: 8843 http://www.securityfocus.com/bid/8843 Bugtraq: 20040220 LNSA-#2004-0002: Fetchmail 6.2.4 and earlier remote denial of service (Google Search) http://marc.info/?l=bugtraq&m=107731542827401&w=2 http://security.gentoo.org/glsa/glsa-200403-10.xml Immunix Linux Advisory: IMNX-2003-7+-023-01 http://www.securityfocus.com/advisories/5987 http://www.mandriva.com/security/advisories?name=MDKSA-2003:101 SCO Security Bulletin: CSSA-2004-004.0 ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Server/CSSA-2004-004.0/CSSA-2004-004.0.txt TurboLinux Advisory: TLSA-2003-61 http://www.turbolinux.com/security/TLSA-2003-61.txt XForce ISS Database: fetchmail-email-dos(13450) https://exchange.xforce.ibmcloud.com/vulnerabilities/13450 Common Vulnerability Exposure (CVE) ID: CVE-2005-2335 http://lists.apple.com/archives/security-announce/2006//Aug/msg00000.html BugTraq ID: 14349 http://www.securityfocus.com/bid/14349 BugTraq ID: 19289 http://www.securityfocus.com/bid/19289 Bugtraq: 20060526 rPSA-2006-0084-1 fetchmail (Google Search) http://www.securityfocus.com/archive/1/435197/100/0/threaded Bugtraq: 20060801 DMA[2006-0801a] - 'Apple OSX fetchmail buffer overflow' (Google Search) http://www.securityfocus.com/archive/1/441856/100/200/threaded Cert/CC Advisory: TA06-214A http://www.us-cert.gov/cas/techalerts/TA06-214A.html Debian Security Information: DSA-774 (Google Search) http://www.debian.org/security/2005/dsa-774 http://www.redhat.com/archives/fedora-announce-list/2005-July/msg00088.html http://www.redhat.com/archives/fedora-announce-list/2005-July/msg00089.html http://www.redhat.com/archives/fedora-announce-list/2005-July/msg00104.html http://www.osvdb.org/18174 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1038 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1124 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8833 http://www.redhat.com/support/errata/RHSA-2005-640.html http://secunia.com/advisories/16176 http://secunia.com/advisories/21253 SuSE Security Announcement: SUSE-SR:2005:018 (Google Search) http://www.novell.com/linux/security/advisories/2005_18_sr.html http://www.vupen.com/english/advisories/2005/1171 http://www.vupen.com/english/advisories/2006/3101 Common Vulnerability Exposure (CVE) ID: CVE-2005-3088 BugTraq ID: 15179 http://www.securityfocus.com/bid/15179 Bugtraq: 20051027 fetchmail security announcement 2005-02 (CVE-2005-3088) (Google Search) http://marc.info/?l=bugtraq&m=113042785902031&w=2 Debian Security Information: DSA-900 (Google Search) http://www.debian.org/security/2005/dsa-900 http://www.gentoo.org/security/en/glsa/glsa-200511-06.xml http://www.mandriva.com/security/advisories?name=MDKSA-2005:209 http://www.osvdb.org/20267 http://www.redhat.com/support/errata/RHSA-2005-823.html http://securitytracker.com/id?1015114 http://secunia.com/advisories/17293 http://secunia.com/advisories/17349 http://secunia.com/advisories/17446 http://secunia.com/advisories/17491 http://secunia.com/advisories/17495 http://secunia.com/advisories/17631 http://secunia.com/advisories/18895 http://slackware.com/security/viewer.php?l=slackware-security&y=2006&m=slackware-security.443499 https://usn.ubuntu.com/215-1/ http://www.vupen.com/english/advisories/2005/2182 Common Vulnerability Exposure (CVE) ID: CVE-2005-4348 BugTraq ID: 15987 http://www.securityfocus.com/bid/15987 Bugtraq: 20051221 fetchmail security announcement fetchmail-SA-2005-03 (CVE-2005-4348) (Google Search) http://www.securityfocus.com/archive/1/420098/100/0/threaded Debian Security Information: DSA-939 (Google Search) http://www.debian.org/security/2005/dsa-939 http://wwwnew.mandriva.com/security/advisories?name=MDKSA-2005:236 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=343836 http://www.osvdb.org/21906 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9659 http://www.redhat.com/support/errata/RHSA-2007-0018.html http://securitytracker.com/id?1015383 http://secunia.com/advisories/17891 http://secunia.com/advisories/18172 http://secunia.com/advisories/18231 http://secunia.com/advisories/18266 http://secunia.com/advisories/18433 http://secunia.com/advisories/18463 http://secunia.com/advisories/24007 http://secunia.com/advisories/24284 SGI Security Advisory: 20070201-01-P ftp://patches.sgi.com/support/free/security/advisories/20070201-01-P.asc SuSE Security Announcement: SUSE-SR:2007:004 (Google Search) http://www.novell.com/linux/security/advisories/2007_4_sr.html http://www.trustix.org/errata/2006/0002/ https://usn.ubuntu.com/233-1/ http://www.vupen.com/english/advisories/2005/2996 XForce ISS Database: fetchmail-null-pointer-dos(23713) https://exchange.xforce.ibmcloud.com/vulnerabilities/23713
Copyright	Copyright (c) 2006 E-Soft Inc. http://www.securityspace.com

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.