Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2007.0069 -- [RedHat] Moderate: fetchmail security update 1 February 2007 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: fetchmail Publisher: Red Hat Operating System: Red Hat Enterprise Linux Desktop 4 Red Hat Enterprise Linux AS/ES/WS 4 Red Hat Desktop 3 Red Hat Enterprise Linux AS/ES/WS 3 Red Hat Linux Advanced Workstation 2.1 Red Hat Enterprise Linux AS/ES/WS 2.1 Impact: Inappropriate Access Denial of Service Access: Remote/Unauthenticated CVE Names: CVE-2006-5867 CVE-2005-4348 Ref: ESB-2007.0008 ESB-2006.0047 Original Bulletin: https://rhn.redhat.com/errata/RHSA-2007-0018.html - --------------------------BEGIN INCLUDED TEXT-------------------- - -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - - --------------------------------------------------------------------- Red Hat Security Advisory Synopsis: Moderate: fetchmail security update Advisory ID: RHSA-2007:0018-01 Advisory URL: https://rhn.redhat.com/errata/RHSA-2007-0018.html Issue date: 2007-01-31 Updated on: 2007-01-31 Product: Red Hat Enterprise Linux Keywords: multidrop TLS POP3 CVE Names: CVE-2005-4348 CVE-2006-5867 - - --------------------------------------------------------------------- 1. Summary: Updated fetchmail packages that fix two security issues are now available. This update has been rated as having moderate security impact by the Red Hat Security Response Team. 2. Relevant releases/architectures: Red Hat Enterprise Linux AS (Advanced Server) version 2.1 - i386, ia64 Red Hat Linux Advanced Workstation 2.1 - ia64 Red Hat Enterprise Linux ES version 2.1 - i386 Red Hat Enterprise Linux WS version 2.1 - i386 Red Hat Enterprise Linux AS version 3 - i386, ia64, ppc, s390, s390x, x86_64 Red Hat Desktop version 3 - i386, x86_64 Red Hat Enterprise Linux ES version 3 - i386, ia64, x86_64 Red Hat Enterprise Linux WS version 3 - i386, ia64, x86_64 Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, s390, s390x, x86_64 Red Hat Enterprise Linux Desktop version 4 - i386, x86_64 Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64 Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64 3. Problem description: Fetchmail is a remote mail retrieval and forwarding utility. A denial of service flaw was found when Fetchmail was run in multidrop mode. A malicious mail server could send a message without headers which would cause Fetchmail to crash (CVE-2005-4348). This issue did not affect the version of Fetchmail shipped with Red Hat Enterprise Linux 2.1 or 3. A flaw was found in the way Fetchmail used TLS encryption to connect to remote hosts. Fetchmail provided no way to enforce the use of TLS encryption and would not authenticate POP3 protocol connections properly (CVE-2006-5867). This update corrects this issue by enforcing TLS encryption when the "sslproto" configuration directive is set to "tls1". Users of Fetchmail should update to these packages, which contain backported patches to correct these issues. Note: This update may break configurations which assumed that Fetchmail would use plain-text authentication if TLS encryption is not supported by the POP3 server even if the "sslproto" directive is set to "tls1". If you are using a custom configuration that depended on this behavior you will need to modify your configuration appropriately after installing this update. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via Red Hat Network. To use Red Hat Network, launch the Red Hat Update Agent with the following command: up2date This will start an interactive process that will result in the appropriate RPMs being upgraded on your system. 5. Bug IDs fixed (http://bugzilla.redhat.com/): 176266 - CVE-2005-4348 Fetchmail DOS by malicious server in multidrop mode 221981 - CVE-2006-5867 fetchmail not enforcing TLS for POP3 properly 6. RPMs required: Red Hat Enterprise Linux AS (Advanced Server) version 2.1: SRPMS: ftp://updates.redhat.com/enterprise/2.1AS/en/os/SRPMS/fetchmail-5.9.0-21.7.3.el2.1.4.src.rpm fab2904aa98dfe5fe2eb75f6102b3732 fetchmail-5.9.0-21.7.3.el2.1.4.src.rpm i386: e31563e2dfc8c932217bd1c7f7b1240b fetchmail-5.9.0-21.7.3.el2.1.4.i386.rpm 9a97eff50a8354245833c2a49e18ceda fetchmailconf-5.9.0-21.7.3.el2.1.4.i386.rpm ia64: c05a0909788b58915df9ba7123291719 fetchmail-5.9.0-21.7.3.el2.1.4.ia64.rpm 1c014f448b74cfec7b8ba41f6eca0b0c fetchmailconf-5.9.0-21.7.3.el2.1.4.ia64.rpm Red Hat Linux Advanced Workstation 2.1: SRPMS: ftp://updates.redhat.com/enterprise/2.1AW/en/os/SRPMS/fetchmail-5.9.0-21.7.3.el2.1.4.src.rpm fab2904aa98dfe5fe2eb75f6102b3732 fetchmail-5.9.0-21.7.3.el2.1.4.src.rpm ia64: c05a0909788b58915df9ba7123291719 fetchmail-5.9.0-21.7.3.el2.1.4.ia64.rpm 1c014f448b74cfec7b8ba41f6eca0b0c fetchmailconf-5.9.0-21.7.3.el2.1.4.ia64.rpm Red Hat Enterprise Linux ES version 2.1: SRPMS: ftp://updates.redhat.com/enterprise/2.1ES/en/os/SRPMS/fetchmail-5.9.0-21.7.3.el2.1.4.src.rpm fab2904aa98dfe5fe2eb75f6102b3732 fetchmail-5.9.0-21.7.3.el2.1.4.src.rpm i386: e31563e2dfc8c932217bd1c7f7b1240b fetchmail-5.9.0-21.7.3.el2.1.4.i386.rpm 9a97eff50a8354245833c2a49e18ceda fetchmailconf-5.9.0-21.7.3.el2.1.4.i386.rpm Red Hat Enterprise Linux WS version 2.1: SRPMS: ftp://updates.redhat.com/enterprise/2.1WS/en/os/SRPMS/fetchmail-5.9.0-21.7.3.el2.1.4.src.rpm fab2904aa98dfe5fe2eb75f6102b3732 fetchmail-5.9.0-21.7.3.el2.1.4.src.rpm i386: e31563e2dfc8c932217bd1c7f7b1240b fetchmail-5.9.0-21.7.3.el2.1.4.i386.rpm 9a97eff50a8354245833c2a49e18ceda fetchmailconf-5.9.0-21.7.3.el2.1.4.i386.rpm Red Hat Enterprise Linux AS version 3: SRPMS: ftp://updates.redhat.com/enterprise/3AS/en/os/SRPMS/fetchmail-6.2.0-3.el3.3.src.rpm 786e014898c168c69f44da351ca0522b fetchmail-6.2.0-3.el3.3.src.rpm i386: d35be6f0a4f0e4b9a2fcdd134bf5da53 fetchmail-6.2.0-3.el3.3.i386.rpm a510ee49f4ca088b480d7762085f3e8d fetchmail-debuginfo-6.2.0-3.el3.3.i386.rpm ia64: eb95e7909232fcc77c4ecf6ebd260580 fetchmail-6.2.0-3.el3.3.ia64.rpm 577cbd3f17e1ac11ebbf585fe7050881 fetchmail-debuginfo-6.2.0-3.el3.3.ia64.rpm ppc: 057e6c3f061f3a745d9c53e182d152cb fetchmail-6.2.0-3.el3.3.ppc.rpm 7701074d387923319b195cc3e368b960 fetchmail-debuginfo-6.2.0-3.el3.3.ppc.rpm s390: ccd9e8d06484c8a7ac748dfa46c0b8f2 fetchmail-6.2.0-3.el3.3.s390.rpm 7657fa6b53b1107a18aa7869ec771bd7 fetchmail-debuginfo-6.2.0-3.el3.3.s390.rpm s390x: 7974a79684df3749e326b5a96b054616 fetchmail-6.2.0-3.el3.3.s390x.rpm e7eaf5ae18697113bd81961c4a3e55a1 fetchmail-debuginfo-6.2.0-3.el3.3.s390x.rpm x86_64: d4ac2065f887e9ae72dda8aeedd697e7 fetchmail-6.2.0-3.el3.3.x86_64.rpm 81354d8098561020166e6cc0ed3a9d8e fetchmail-debuginfo-6.2.0-3.el3.3.x86_64.rpm Red Hat Desktop version 3: SRPMS: ftp://updates.redhat.com/enterprise/3desktop/en/os/SRPMS/fetchmail-6.2.0-3.el3.3.src.rpm 786e014898c168c69f44da351ca0522b fetchmail-6.2.0-3.el3.3.src.rpm i386: d35be6f0a4f0e4b9a2fcdd134bf5da53 fetchmail-6.2.0-3.el3.3.i386.rpm a510ee49f4ca088b480d7762085f3e8d fetchmail-debuginfo-6.2.0-3.el3.3.i386.rpm x86_64: d4ac2065f887e9ae72dda8aeedd697e7 fetchmail-6.2.0-3.el3.3.x86_64.rpm 81354d8098561020166e6cc0ed3a9d8e fetchmail-debuginfo-6.2.0-3.el3.3.x86_64.rpm Red Hat Enterprise Linux ES version 3: SRPMS: ftp://updates.redhat.com/enterprise/3ES/en/os/SRPMS/fetchmail-6.2.0-3.el3.3.src.rpm 786e014898c168c69f44da351ca0522b fetchmail-6.2.0-3.el3.3.src.rpm i386: d35be6f0a4f0e4b9a2fcdd134bf5da53 fetchmail-6.2.0-3.el3.3.i386.rpm a510ee49f4ca088b480d7762085f3e8d fetchmail-debuginfo-6.2.0-3.el3.3.i386.rpm ia64: eb95e7909232fcc77c4ecf6ebd260580 fetchmail-6.2.0-3.el3.3.ia64.rpm 577cbd3f17e1ac11ebbf585fe7050881 fetchmail-debuginfo-6.2.0-3.el3.3.ia64.rpm x86_64: d4ac2065f887e9ae72dda8aeedd697e7 fetchmail-6.2.0-3.el3.3.x86_64.rpm 81354d8098561020166e6cc0ed3a9d8e fetchmail-debuginfo-6.2.0-3.el3.3.x86_64.rpm Red Hat Enterprise Linux WS version 3: SRPMS: ftp://updates.redhat.com/enterprise/3WS/en/os/SRPMS/fetchmail-6.2.0-3.el3.3.src.rpm 786e014898c168c69f44da351ca0522b fetchmail-6.2.0-3.el3.3.src.rpm i386: d35be6f0a4f0e4b9a2fcdd134bf5da53 fetchmail-6.2.0-3.el3.3.i386.rpm a510ee49f4ca088b480d7762085f3e8d fetchmail-debuginfo-6.2.0-3.el3.3.i386.rpm ia64: eb95e7909232fcc77c4ecf6ebd260580 fetchmail-6.2.0-3.el3.3.ia64.rpm 577cbd3f17e1ac11ebbf585fe7050881 fetchmail-debuginfo-6.2.0-3.el3.3.ia64.rpm x86_64: d4ac2065f887e9ae72dda8aeedd697e7 fetchmail-6.2.0-3.el3.3.x86_64.rpm 81354d8098561020166e6cc0ed3a9d8e fetchmail-debuginfo-6.2.0-3.el3.3.x86_64.rpm Red Hat Enterprise Linux AS version 4: SRPMS: ftp://updates.redhat.com/enterprise/4AS/en/os/SRPMS/fetchmail-6.2.5-6.el4.5.src.rpm 3c4f4b1ddbb6ce8ffc4d725e17acc9a7 fetchmail-6.2.5-6.el4.5.src.rpm i386: 3e2ab1a0a90e68e25290e834b9b3fc30 fetchmail-6.2.5-6.el4.5.i386.rpm 85d86e137158281b3e59ad77bdef489c fetchmail-debuginfo-6.2.5-6.el4.5.i386.rpm ia64: ccc7ed6a3de49200aa3c86dd1919bb0a fetchmail-6.2.5-6.el4.5.ia64.rpm 75ad1e0cc2c6d72baa0ea9e9122c2501 fetchmail-debuginfo-6.2.5-6.el4.5.ia64.rpm ppc: 9b781df3ade717d6276af0c922a13b22 fetchmail-6.2.5-6.el4.5.ppc.rpm 8a12686eb7df7a4cd789bc1e371d8441 fetchmail-debuginfo-6.2.5-6.el4.5.ppc.rpm s390: 62dcc2fed3115cafaedff2db94e35377 fetchmail-6.2.5-6.el4.5.s390.rpm dc72a4bc097f2c3fb614b987fb618b52 fetchmail-debuginfo-6.2.5-6.el4.5.s390.rpm s390x: 1e8b28798ad17fd9d498cfbd5e8f5820 fetchmail-6.2.5-6.el4.5.s390x.rpm dd46c126b674008eb8ed9f91e419c045 fetchmail-debuginfo-6.2.5-6.el4.5.s390x.rpm x86_64: 806adc07ed6a1ec9a3e24f59e9e143c9 fetchmail-6.2.5-6.el4.5.x86_64.rpm 89821346e8d9cf156a46ac53fbf8142e fetchmail-debuginfo-6.2.5-6.el4.5.x86_64.rpm Red Hat Enterprise Linux Desktop version 4: SRPMS: ftp://updates.redhat.com/enterprise/4Desktop/en/os/SRPMS/fetchmail-6.2.5-6.el4.5.src.rpm 3c4f4b1ddbb6ce8ffc4d725e17acc9a7 fetchmail-6.2.5-6.el4.5.src.rpm i386: 3e2ab1a0a90e68e25290e834b9b3fc30 fetchmail-6.2.5-6.el4.5.i386.rpm 85d86e137158281b3e59ad77bdef489c fetchmail-debuginfo-6.2.5-6.el4.5.i386.rpm x86_64: 806adc07ed6a1ec9a3e24f59e9e143c9 fetchmail-6.2.5-6.el4.5.x86_64.rpm 89821346e8d9cf156a46ac53fbf8142e fetchmail-debuginfo-6.2.5-6.el4.5.x86_64.rpm Red Hat Enterprise Linux ES version 4: SRPMS: ftp://updates.redhat.com/enterprise/4ES/en/os/SRPMS/fetchmail-6.2.5-6.el4.5.src.rpm 3c4f4b1ddbb6ce8ffc4d725e17acc9a7 fetchmail-6.2.5-6.el4.5.src.rpm i386: 3e2ab1a0a90e68e25290e834b9b3fc30 fetchmail-6.2.5-6.el4.5.i386.rpm 85d86e137158281b3e59ad77bdef489c fetchmail-debuginfo-6.2.5-6.el4.5.i386.rpm ia64: ccc7ed6a3de49200aa3c86dd1919bb0a fetchmail-6.2.5-6.el4.5.ia64.rpm 75ad1e0cc2c6d72baa0ea9e9122c2501 fetchmail-debuginfo-6.2.5-6.el4.5.ia64.rpm x86_64: 806adc07ed6a1ec9a3e24f59e9e143c9 fetchmail-6.2.5-6.el4.5.x86_64.rpm 89821346e8d9cf156a46ac53fbf8142e fetchmail-debuginfo-6.2.5-6.el4.5.x86_64.rpm Red Hat Enterprise Linux WS version 4: SRPMS: ftp://updates.redhat.com/enterprise/4WS/en/os/SRPMS/fetchmail-6.2.5-6.el4.5.src.rpm 3c4f4b1ddbb6ce8ffc4d725e17acc9a7 fetchmail-6.2.5-6.el4.5.src.rpm i386: 3e2ab1a0a90e68e25290e834b9b3fc30 fetchmail-6.2.5-6.el4.5.i386.rpm 85d86e137158281b3e59ad77bdef489c fetchmail-debuginfo-6.2.5-6.el4.5.i386.rpm ia64: ccc7ed6a3de49200aa3c86dd1919bb0a fetchmail-6.2.5-6.el4.5.ia64.rpm 75ad1e0cc2c6d72baa0ea9e9122c2501 fetchmail-debuginfo-6.2.5-6.el4.5.ia64.rpm x86_64: 806adc07ed6a1ec9a3e24f59e9e143c9 fetchmail-6.2.5-6.el4.5.x86_64.rpm 89821346e8d9cf156a46ac53fbf8142e fetchmail-debuginfo-6.2.5-6.el4.5.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://www.redhat.com/security/team/key/#package 7. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-4348 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-5867 http://fetchmail.berlios.de/fetchmail-SA-2005-03.txt http://fetchmail.berlios.de/fetchmail-SA-2006-03.txt http://www.redhat.com/security/updates/classification/#moderate 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://www.redhat.com/security/team/contact/ Copyright 2007 Red Hat, Inc. - -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.4 (GNU/Linux) iD8DBQFFwNASXlSAg2UNWIIRAou/AKCJBspirSpcDvZSIkUSVLPb95YOEQCgw5EJ +owkLzFgGnwcLKF4ZFoJfig= =lMbT - -----END PGP SIGNATURE----- - --------------------------END INCLUDED TEXT-------------------- You have received this e-mail bulletin as a result of your organisation's registration with AusCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to auscert@auscert.org.au and we will forward your request to the appropriate person. NOTE: Third Party Rights This security bulletin is provided as a service to AusCERT's members. As AusCERT did not write the document quoted above, AusCERT has had no control over its content. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the author's website to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: http://www.auscert.org.au/render.html?cid=1980 If you believe that your computer system has been compromised or attacked in any way, we encourage you to let us know by completing the secure National IT Incident Reporting Form at: http://www.auscert.org.au/render.html?it=3192 =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: http://www.auscert.org.au/render.html?it=1967 iQCVAwUBRcFNYCh9+71yA2DNAQLqYwP/YQ6Eex+/rloq+GQuzpEXVaw/w4jDV+F0 mG30bLkDWECrlR2xVW6uzGhItuUWujVWAwxSMDgQGX8VPg5TpRAO4ZO8HmZ/X4kz UhKZsxwG5eQr/sftVa2WF1hK8uYG5vpoWm2E5mZ8reXYoSbtF9RXmD2YK8jsJ5/i /WL1e7X1JU4= =2dL/ -----END PGP SIGNATURE-----