From 633990035597dd465945c03e9633ab16ebfe51cb Mon Sep 17 00:00:00 2001 From: barner Date: Fri, 22 Jul 2005 09:44:32 +0000 Subject: Document denial of service attack in fetchmail 6.5.2.1. Reported by: Matthias Andree Reviewed by: simon --- security/vuxml/vuln.xml | 30 ++++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+) (limited to 'security/vuxml') diff --git a/security/vuxml/vuln.xml b/security/vuxml/vuln.xml index eab91cfb00c2..2c2b7cc1e30a 100644 --- a/security/vuxml/vuln.xml +++ b/security/vuxml/vuln.xml @@ -32,6 +32,36 @@ EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. --> + + fetchmail -- denial of service/crash from malicious POP3 server + + + fetchmail + 6.2.5.1 + + + + +

In fetchmail 6.2.5.1, the the remote code injection via + POP3 UIDL was fixed, but a denial of service attack was + introduced:

Two possible NULL-pointer dereferences allow a malicous + POP3 server to crash fetchmail by respondig with UID lines + containing only the article number but no UID (in violation + of RFC-1939), or a message without Message-ID when no UIDL + support is available.

+ + + + http://lists.berlios.de/pipermail/fetchmail-devel/2005-July/000397.html + http://fetchmail.berlios.de/fetchmail-SA-2005-01.txt + + + 2005-07-21 + 2005-07-22 + + + dnrd -- remote buffer and stack overflow vulnerabilities -- cgit