Vulnerability   
Search   
    Search 219043 CVE descriptions
and 99761 test descriptions,
access 10,000+ cross references.
Tests   CVE   All  

Test ID:1.3.6.1.4.1.25623.1.0.58028
Category:Turbolinux Local Security Tests
Title:Turbolinux TLSA-2007-3 (fetchmail)
Summary:NOSUMMARY
Description:Description:

The remote host is missing an update to fetchmail
announced via advisory TLSA-2007-3.

fetchmail is a software package to retrieve mail from remote POP2, POP3,
IMAP, ETRN or ODMR servers and forward it to local SMTP, LMTP servers or
message delivery agents.

Crash retrieving headerless message in multidrop mode.
Passwords are written to a world-readable file.
Cleartext passwords over unsecured links.

When configured for multidrop mode, allows remote attackers to cause a
denial of service (application crash) by sending messages without headers
from upstream mail servers.
Creates configuration files with insecure world-readable permissions, which
allows local users to obtain sensitive information such as passwords.
Transmit cleartext passwords over unsecured links

Solution: Please use the turbopkg (zabom) tool to apply the update.
http://www.securityspace.com/smysecure/catid.html?in=TLSA-2007-3

Risk factor : High

CVSS Score:
7.8

Cross-Ref: Common Vulnerability Exposure (CVE) ID: CVE-2005-4348
BugTraq ID: 15987
http://www.securityfocus.com/bid/15987
BugTraq ID: 19289
http://www.securityfocus.com/bid/19289
Bugtraq: 20051221 fetchmail security announcement fetchmail-SA-2005-03 (CVE-2005-4348) (Google Search)
http://www.securityfocus.com/archive/1/420098/100/0/threaded
Bugtraq: 20060526 rPSA-2006-0084-1 fetchmail (Google Search)
http://www.securityfocus.com/archive/1/435197/100/0/threaded
Debian Security Information: DSA-939 (Google Search)
http://www.debian.org/security/2005/dsa-939
http://wwwnew.mandriva.com/security/advisories?name=MDKSA-2005:236
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=343836
http://www.osvdb.org/21906
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9659
http://www.redhat.com/support/errata/RHSA-2007-0018.html
http://securitytracker.com/id?1015383
http://secunia.com/advisories/17891
http://secunia.com/advisories/18172
http://secunia.com/advisories/18231
http://secunia.com/advisories/18266
http://secunia.com/advisories/18433
http://secunia.com/advisories/18463
http://secunia.com/advisories/18895
http://secunia.com/advisories/21253
http://secunia.com/advisories/24007
http://secunia.com/advisories/24284
SGI Security Advisory: 20070201-01-P
ftp://patches.sgi.com/support/free/security/advisories/20070201-01-P.asc
http://slackware.com/security/viewer.php?l=slackware-security&y=2006&m=slackware-security.443499
SuSE Security Announcement: SUSE-SR:2007:004 (Google Search)
http://www.novell.com/linux/security/advisories/2007_4_sr.html
http://www.trustix.org/errata/2006/0002/
https://usn.ubuntu.com/233-1/
http://www.vupen.com/english/advisories/2005/2996
http://www.vupen.com/english/advisories/2006/3101
XForce ISS Database: fetchmail-null-pointer-dos(23713)
https://exchange.xforce.ibmcloud.com/vulnerabilities/23713
Common Vulnerability Exposure (CVE) ID: CVE-2005-3088
http://lists.apple.com/archives/security-announce/2006//Aug/msg00000.html
BugTraq ID: 15179
http://www.securityfocus.com/bid/15179
Bugtraq: 20051027 fetchmail security announcement 2005-02 (CVE-2005-3088) (Google Search)
http://marc.info/?l=bugtraq&m=113042785902031&w=2
Cert/CC Advisory: TA06-214A
http://www.us-cert.gov/cas/techalerts/TA06-214A.html
Debian Security Information: DSA-900 (Google Search)
http://www.debian.org/security/2005/dsa-900
http://www.gentoo.org/security/en/glsa/glsa-200511-06.xml
http://www.mandriva.com/security/advisories?name=MDKSA-2005:209
http://www.osvdb.org/20267
http://www.redhat.com/support/errata/RHSA-2005-823.html
http://securitytracker.com/id?1015114
http://secunia.com/advisories/17293
http://secunia.com/advisories/17349
http://secunia.com/advisories/17446
http://secunia.com/advisories/17491
http://secunia.com/advisories/17495
http://secunia.com/advisories/17631
https://usn.ubuntu.com/215-1/
http://www.vupen.com/english/advisories/2005/2182
Common Vulnerability Exposure (CVE) ID: CVE-2006-5867
http://lists.apple.com/archives/Security-announce/2007/Apr/msg00001.html
BugTraq ID: 21903
http://www.securityfocus.com/bid/21903
Bugtraq: 20070105 fetchmail security announcement 2006-02 (CVE-2006-5867) (Google Search)
http://www.securityfocus.com/archive/1/456115/100/0/threaded
Bugtraq: 20070218 Re: [SECURITY] [DSA 1259-1] New fetchmail packages fix information disclosure (Google Search)
http://www.securityfocus.com/archive/1/460528/100/0/threaded
Cert/CC Advisory: TA07-109A
http://www.us-cert.gov/cas/techalerts/TA07-109A.html
Debian Security Information: DSA-1259 (Google Search)
http://www.debian.org/security/2007/dsa-1259
http://fedoranews.org/cms/node/2429
http://security.gentoo.org/glsa/glsa-200701-13.xml
http://www.mandriva.com/security/advisories?name=MDKSA-2007:016
http://www.openpkg.com/security/advisories/OpenPKG-SA-2007.004.html
http://osvdb.org/31580
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10566
http://securitytracker.com/id?1017478
http://secunia.com/advisories/23631
http://secunia.com/advisories/23695
http://secunia.com/advisories/23714
http://secunia.com/advisories/23781
http://secunia.com/advisories/23804
http://secunia.com/advisories/23838
http://secunia.com/advisories/23923
http://secunia.com/advisories/24151
http://secunia.com/advisories/24174
http://secunia.com/advisories/24966
http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.517995
http://www.trustix.org/errata/2007/0007
http://www.ubuntu.com/usn/usn-405-1
http://www.vupen.com/english/advisories/2007/0087
http://www.vupen.com/english/advisories/2007/0088
http://www.vupen.com/english/advisories/2007/1470
CopyrightCopyright (c) 2007 E-Soft Inc. http://www.securityspace.com

This is only one of 99761 vulnerability tests in our test suite. Find out more about running a complete security audit.

To run a free test of this vulnerability against your system, register below.




© 1998-2024 E-Soft Inc. All rights reserved.