fetchmail security update

2007-06-0709:31:34

CentOS Project

lists.centos.org

CVSS2

2.6

Attack Vector

NETWORK

Attack Complexity

HIGH

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:H/Au:N/C:P/I:N/A:N

EPSS

0.088

Percentile

94.6%

JSON

CentOS Errata and Security Advisory CESA-2007:0385

Fetchmail is a remote mail retrieval and forwarding utility intended
for use over on-demand TCP/IP links, like SLIP or PPP connections.

A flaw was found in the way fetchmail processed certain APOP authentication
requests. By sending certain responses when fetchmail attempted to
authenticate against an APOP server, a remote attacker could potentially
acquire certain portions of a user’s authentication credentials.
(CVE-2007-1558)

All users of fetchmail should upgrade to this updated package, which
contains a backported patch to correct this issue.

Affected packages:
fetchmail

Upstream details at:
https://access.redhat.com/errata/RHSA-2007:0385

OSVersionArchitecturePackageVersionFilename
CentOS3i386fetchmail< 6.2.0-3.el3.4fetchmail-6.2.0-3.el3.4.i386.rpm
CentOS3x86_64fetchmail< 6.2.0-3.el3.4fetchmail-6.2.0-3.el3.4.x86_64.rpm
CentOS5i386fetchmail< 6.3.6-1.0.1.el5fetchmail-6.3.6-1.0.1.el5.i386.rpm
CentOS5x86_64fetchmail< 6.3.6-1.0.1.el5fetchmail-6.3.6-1.0.1.el5.x86_64.rpm
CentOS3ia64fetchmail< 6.2.0-3.el3.4fetchmail-6.2.0-3.el3.4.ia64.rpm
CentOS4ia64fetchmail< 6.2.5-6.0.1.el4fetchmail-6.2.5-6.0.1.el4.ia64.rpm
CentOS3s390fetchmail< 6.2.0-3.el3.4fetchmail-6.2.0-3.el3.4.s390.rpm
CentOS3s390xfetchmail< 6.2.0-3.el3.4fetchmail-6.2.0-3.el3.4.s390x.rpm
CentOS4s390fetchmail< 6.2.5-6.0.1.el4fetchmail-6.2.5-6.0.1.el4.s390.rpm
CentOS4s390xfetchmail< 6.2.5-6.0.1.el4fetchmail-6.2.5-6.0.1.el4.s390x.rpm

OS	Version	Architecture	Package	Version	Filename
CentOS	3	i386	fetchmail	< 6.2.0-3.el3.4	fetchmail-6.2.0-3.el3.4.i386.rpm
CentOS	3	x86_64	fetchmail	< 6.2.0-3.el3.4	fetchmail-6.2.0-3.el3.4.x86_64.rpm
CentOS	5	i386	fetchmail	< 6.3.6-1.0.1.el5	fetchmail-6.3.6-1.0.1.el5.i386.rpm
CentOS	5	x86_64	fetchmail	< 6.3.6-1.0.1.el5	fetchmail-6.3.6-1.0.1.el5.x86_64.rpm
CentOS	3	ia64	fetchmail	< 6.2.0-3.el3.4	fetchmail-6.2.0-3.el3.4.ia64.rpm
CentOS	4	ia64	fetchmail	< 6.2.5-6.0.1.el4	fetchmail-6.2.5-6.0.1.el4.ia64.rpm
CentOS	3	s390	fetchmail	< 6.2.0-3.el3.4	fetchmail-6.2.0-3.el3.4.s390.rpm
CentOS	3	s390x	fetchmail	< 6.2.0-3.el3.4	fetchmail-6.2.0-3.el3.4.s390x.rpm
CentOS	4	s390	fetchmail	< 6.2.5-6.0.1.el4	fetchmail-6.2.5-6.0.1.el4.s390.rpm
CentOS	4	s390x	fetchmail	< 6.2.5-6.0.1.el4	fetchmail-6.2.5-6.0.1.el4.s390x.rpm