Fetchmail 6.2.5 fixes a remote DoS

1. Gentoo Linux Security Advisory

Advisory Reference	GLSA 200403-10 / fetchmail
Release Date	March 30, 2004
Latest Revision	March 30, 2004: 01
Impact	normal
Exploitable	remote

Package	Vulnerable versions	Unaffected versions	Architecture(s)
net-mail/fetchmail	<= 6.2.4	>= 6.2.5	All supported architectures

Related bugreports: #37717

Synopsis

Fetchmail versions 6.2.4 and earlier can be crashed by sending a specially-crafted email to a fetchmail user.

2. Impact Information

Background

Fetchmail is a utility that retrieves and forwards mail from remote systems using IMAP, POP, and other protocols.

Description

Fetchmail versions 6.2.4 and earlier can be crashed by sending a specially-crafted email to a fetchmail user. This problem occurs because Fetchmail does not properly allocate memory for long lines in an incoming email.

Impact

Fetchmail users who receive a malicious email may have their fetchmail program crash.

3. Resolution Information

Workaround

While a workaround is not currently known for this issue, all users are advised to upgrade to the latest version of fetchmail.

Resolution

Fetchmail users should upgrade to version 6.2.5 or later:

Code Listing 3.1: Resolution

# emerge sync
# emerge -pv ">=net-mail/fetchmail-6.2.5"
# emerge ">=net-mail/fetchmail-6.2.5"

4. References

Page updated March 30, 2004

Summary: This is a Gentoo Linux Security Advisory

Security Team
Contact Address

Donate to support our development efforts.