Skip to navigation

Security Advisory Moderate: fetchmail security update

Advisory: RHSA-2009:1427-1
Type: Security Advisory
Severity: Moderate
Issued on: 2009-09-08
Last updated on: 2009-09-08
Affected Products: RHEL Desktop Workstation (v. 5 client)
Red Hat Desktop (v. 3)
Red Hat Desktop (v. 4)
Red Hat Enterprise Linux (v. 5 server)
Red Hat Enterprise Linux AS (v. 3)
Red Hat Enterprise Linux AS (v. 4)
Red Hat Enterprise Linux AS (v. 4.8.z)
Red Hat Enterprise Linux ES (v. 3)
Red Hat Enterprise Linux ES (v. 4)
Red Hat Enterprise Linux ES (v. 4.8.z)
Red Hat Enterprise Linux EUS (v. 5.4.z server)
Red Hat Enterprise Linux WS (v. 3)
Red Hat Enterprise Linux WS (v. 4)
CVEs (cve.mitre.org): CVE-2007-4565
CVE-2008-2711
CVE-2009-2666

Details

An updated fetchmail package that fixes multiple security issues is now
available for Red Hat Enterprise Linux 3, 4, and 5.

This update has been rated as having moderate security impact by the Red
Hat Security Response Team.

Fetchmail is a remote mail retrieval and forwarding utility intended for
use over on-demand TCP/IP links, such as SLIP and PPP connections.

It was discovered that fetchmail is affected by the previously published
"null prefix attack", caused by incorrect handling of NULL characters in
X.509 certificates. If an attacker is able to get a carefully-crafted
certificate signed by a trusted Certificate Authority, the attacker could
use the certificate during a man-in-the-middle attack and potentially
confuse fetchmail into accepting it by mistake. (CVE-2009-2666)

A flaw was found in the way fetchmail handles rejections from a remote SMTP
server when sending warning mail to the postmaster. If fetchmail sent a
warning mail to the postmaster of an SMTP server and that SMTP server
rejected it, fetchmail could crash. (CVE-2007-4565)

A flaw was found in fetchmail. When fetchmail is run in double verbose
mode ("-v -v"), it could crash upon receiving certain, malformed mail
messages with long headers. A remote attacker could use this flaw to cause
a denial of service if fetchmail was also running in daemon mode ("-d").
(CVE-2008-2711)

Note: when using SSL-enabled services, it is recommended that the fetchmail
"--sslcertck" option be used to enforce strict SSL certificate checking.

All fetchmail users should upgrade to this updated package, which contains
backported patches to correct these issues. If fetchmail is running in
daemon mode, it must be restarted for this update to take effect (use the
"fetchmail --quit" command to stop the fetchmail process).


Solution

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.

This update is available via Red Hat Network. Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/docs/DOC-11259

Updated packages

RHEL Desktop Workstation (v. 5 client)

SRPMS:
fetchmail-6.3.6-1.1.el5_3.1.src.rpm
File outdated by:  RHBA-2011:1540
    MD5: c44d63b216ceb886eaad7fd5db39e52a
 
IA-32:
fetchmail-6.3.6-1.1.el5_3.1.i386.rpm
File outdated by:  RHBA-2011:1540
    MD5: 69f71d326595390703879cb9de64d0f6
 
x86_64:
fetchmail-6.3.6-1.1.el5_3.1.x86_64.rpm
File outdated by:  RHBA-2011:1540
    MD5: 57bfcfb4e9acbce565721dd1089b9a1a
 
Red Hat Desktop (v. 3)

SRPMS:
fetchmail-6.2.0-3.el3.5.src.rpm     MD5: c996f5701e742a6d214050e2933cf764
 
IA-32:
fetchmail-6.2.0-3.el3.5.i386.rpm     MD5: 89a3a3abc6132b5f39136d8e2e58d78b
 
x86_64:
fetchmail-6.2.0-3.el3.5.x86_64.rpm     MD5: 7ffe3407ca6478ce7f46eba85bdd7005
 
Red Hat Desktop (v. 4)

SRPMS:
fetchmail-6.2.5-6.0.1.el4_8.1.src.rpm     MD5: b1f2fdffbf281d498cc2b5f5285bd800
 
IA-32:
fetchmail-6.2.5-6.0.1.el4_8.1.i386.rpm     MD5: 1f19ec192259e2b6a96daa097a13daa6
 
x86_64:
fetchmail-6.2.5-6.0.1.el4_8.1.x86_64.rpm     MD5: 7b4c06490c92b41bd892f4143017d211
 
Red Hat Enterprise Linux (v. 5 server)

SRPMS:
fetchmail-6.3.6-1.1.el5_3.1.src.rpm
File outdated by:  RHBA-2011:1540
    MD5: c44d63b216ceb886eaad7fd5db39e52a
 
IA-32:
fetchmail-6.3.6-1.1.el5_3.1.i386.rpm
File outdated by:  RHBA-2011:1540
    MD5: 69f71d326595390703879cb9de64d0f6
 
IA-64:
fetchmail-6.3.6-1.1.el5_3.1.ia64.rpm
File outdated by:  RHBA-2011:1540
    MD5: e708479e4fb69212859f34c34a9b7d81
 
PPC:
fetchmail-6.3.6-1.1.el5_3.1.ppc.rpm
File outdated by:  RHBA-2011:1540
    MD5: c83cf8f5e65c8d51b41416ad541e6ce0
 
s390x:
fetchmail-6.3.6-1.1.el5_3.1.s390x.rpm
File outdated by:  RHBA-2011:1540
    MD5: 0a83f79e3f55a01c4f25d4719c4eae9c
 
x86_64:
fetchmail-6.3.6-1.1.el5_3.1.x86_64.rpm
File outdated by:  RHBA-2011:1540
    MD5: 57bfcfb4e9acbce565721dd1089b9a1a
 
Red Hat Enterprise Linux AS (v. 3)

SRPMS:
fetchmail-6.2.0-3.el3.5.src.rpm     MD5: c996f5701e742a6d214050e2933cf764
 
IA-32:
fetchmail-6.2.0-3.el3.5.i386.rpm     MD5: 89a3a3abc6132b5f39136d8e2e58d78b
 
IA-64:
fetchmail-6.2.0-3.el3.5.ia64.rpm     MD5: 70b6b3e0df0b81a424a12d90d7e4ee72
 
PPC:
fetchmail-6.2.0-3.el3.5.ppc.rpm     MD5: 85229b9f9353fe8d91e57cc009c28cfb
 
s390:
fetchmail-6.2.0-3.el3.5.s390.rpm     MD5: 5a3e2cf880fb7cfb1150c1992fba2f34
 
s390x:
fetchmail-6.2.0-3.el3.5.s390x.rpm     MD5: f5f398f881ca4df836705f5b5b774a0a
 
x86_64:
fetchmail-6.2.0-3.el3.5.x86_64.rpm     MD5: 7ffe3407ca6478ce7f46eba85bdd7005
 
Red Hat Enterprise Linux AS (v. 4)

SRPMS:
fetchmail-6.2.5-6.0.1.el4_8.1.src.rpm     MD5: b1f2fdffbf281d498cc2b5f5285bd800
 
IA-32:
fetchmail-6.2.5-6.0.1.el4_8.1.i386.rpm     MD5: 1f19ec192259e2b6a96daa097a13daa6
 
IA-64:
fetchmail-6.2.5-6.0.1.el4_8.1.ia64.rpm     MD5: ba27ac050545a6e333ab9a06af1cb4ce
 
PPC:
fetchmail-6.2.5-6.0.1.el4_8.1.ppc.rpm     MD5: 80df1d8ef097e257716782c5926f58db
 
s390:
fetchmail-6.2.5-6.0.1.el4_8.1.s390.rpm     MD5: ae44f8d9b9e725ab6f8268922185b91f
 
s390x:
fetchmail-6.2.5-6.0.1.el4_8.1.s390x.rpm     MD5: b8b576f2aa3ecefb8e543bf688e9dd2e
 
x86_64:
fetchmail-6.2.5-6.0.1.el4_8.1.x86_64.rpm     MD5: 7b4c06490c92b41bd892f4143017d211
 
Red Hat Enterprise Linux AS (v. 4.8.z)

SRPMS:
fetchmail-6.2.5-6.0.1.el4_8.1.src.rpm     MD5: b1f2fdffbf281d498cc2b5f5285bd800
 
IA-32:
fetchmail-6.2.5-6.0.1.el4_8.1.i386.rpm     MD5: 1f19ec192259e2b6a96daa097a13daa6
 
IA-64:
fetchmail-6.2.5-6.0.1.el4_8.1.ia64.rpm     MD5: ba27ac050545a6e333ab9a06af1cb4ce
 
PPC:
fetchmail-6.2.5-6.0.1.el4_8.1.ppc.rpm     MD5: 80df1d8ef097e257716782c5926f58db
 
s390:
fetchmail-6.2.5-6.0.1.el4_8.1.s390.rpm     MD5: ae44f8d9b9e725ab6f8268922185b91f
 
s390x:
fetchmail-6.2.5-6.0.1.el4_8.1.s390x.rpm     MD5: b8b576f2aa3ecefb8e543bf688e9dd2e
 
x86_64:
fetchmail-6.2.5-6.0.1.el4_8.1.x86_64.rpm     MD5: 7b4c06490c92b41bd892f4143017d211
 
Red Hat Enterprise Linux ES (v. 3)

SRPMS:
fetchmail-6.2.0-3.el3.5.src.rpm     MD5: c996f5701e742a6d214050e2933cf764
 
IA-32:
fetchmail-6.2.0-3.el3.5.i386.rpm     MD5: 89a3a3abc6132b5f39136d8e2e58d78b
 
IA-64:
fetchmail-6.2.0-3.el3.5.ia64.rpm     MD5: 70b6b3e0df0b81a424a12d90d7e4ee72
 
x86_64:
fetchmail-6.2.0-3.el3.5.x86_64.rpm     MD5: 7ffe3407ca6478ce7f46eba85bdd7005
 
Red Hat Enterprise Linux ES (v. 4)

SRPMS:
fetchmail-6.2.5-6.0.1.el4_8.1.src.rpm     MD5: b1f2fdffbf281d498cc2b5f5285bd800
 
IA-32:
fetchmail-6.2.5-6.0.1.el4_8.1.i386.rpm     MD5: 1f19ec192259e2b6a96daa097a13daa6
 
IA-64:
fetchmail-6.2.5-6.0.1.el4_8.1.ia64.rpm     MD5: ba27ac050545a6e333ab9a06af1cb4ce
 
x86_64:
fetchmail-6.2.5-6.0.1.el4_8.1.x86_64.rpm     MD5: 7b4c06490c92b41bd892f4143017d211
 
Red Hat Enterprise Linux ES (v. 4.8.z)

SRPMS:
fetchmail-6.2.5-6.0.1.el4_8.1.src.rpm     MD5: b1f2fdffbf281d498cc2b5f5285bd800
 
IA-32:
fetchmail-6.2.5-6.0.1.el4_8.1.i386.rpm     MD5: 1f19ec192259e2b6a96daa097a13daa6
 
IA-64:
fetchmail-6.2.5-6.0.1.el4_8.1.ia64.rpm     MD5: ba27ac050545a6e333ab9a06af1cb4ce
 
x86_64:
fetchmail-6.2.5-6.0.1.el4_8.1.x86_64.rpm     MD5: 7b4c06490c92b41bd892f4143017d211
 
Red Hat Enterprise Linux EUS (v. 5.4.z server)

SRPMS:
fetchmail-6.3.6-1.1.el5_3.1.src.rpm
File outdated by:  RHBA-2011:1540
    MD5: c44d63b216ceb886eaad7fd5db39e52a
 
IA-32:
fetchmail-6.3.6-1.1.el5_3.1.i386.rpm     MD5: 69f71d326595390703879cb9de64d0f6
 
IA-64:
fetchmail-6.3.6-1.1.el5_3.1.ia64.rpm     MD5: e708479e4fb69212859f34c34a9b7d81
 
PPC:
fetchmail-6.3.6-1.1.el5_3.1.ppc.rpm     MD5: c83cf8f5e65c8d51b41416ad541e6ce0
 
s390x:
fetchmail-6.3.6-1.1.el5_3.1.s390x.rpm     MD5: 0a83f79e3f55a01c4f25d4719c4eae9c
 
x86_64:
fetchmail-6.3.6-1.1.el5_3.1.x86_64.rpm     MD5: 57bfcfb4e9acbce565721dd1089b9a1a
 
Red Hat Enterprise Linux WS (v. 3)

SRPMS:
fetchmail-6.2.0-3.el3.5.src.rpm     MD5: c996f5701e742a6d214050e2933cf764
 
IA-32:
fetchmail-6.2.0-3.el3.5.i386.rpm     MD5: 89a3a3abc6132b5f39136d8e2e58d78b
 
IA-64:
fetchmail-6.2.0-3.el3.5.ia64.rpm     MD5: 70b6b3e0df0b81a424a12d90d7e4ee72
 
x86_64:
fetchmail-6.2.0-3.el3.5.x86_64.rpm     MD5: 7ffe3407ca6478ce7f46eba85bdd7005
 
Red Hat Enterprise Linux WS (v. 4)

SRPMS:
fetchmail-6.2.5-6.0.1.el4_8.1.src.rpm     MD5: b1f2fdffbf281d498cc2b5f5285bd800
 
IA-32:
fetchmail-6.2.5-6.0.1.el4_8.1.i386.rpm     MD5: 1f19ec192259e2b6a96daa097a13daa6
 
IA-64:
fetchmail-6.2.5-6.0.1.el4_8.1.ia64.rpm     MD5: ba27ac050545a6e333ab9a06af1cb4ce
 
x86_64:
fetchmail-6.2.5-6.0.1.el4_8.1.x86_64.rpm     MD5: 7b4c06490c92b41bd892f4143017d211
 
(The unlinked packages above are only available from the Red Hat Network)

Bugs fixed (see bugzilla for more information)

260601 - CVE-2007-4565 Fetchmail NULL pointer dereference
451758 - CVE-2008-2711 fetchmail: Crash in large log messages in verbose mode
515804 - CVE-2009-2666 fetchmail: SSL null terminator bypass


References



These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from:
https://www.redhat.com/security/team/key/#package

The Red Hat security contact is secalert@redhat.com. More contact details at http://www.redhat.com/security/team/contact/