| Summary: | net-mail/fetchmail DoS issue (CVE-2006-5867 CVE-2006-5974) | ||
|---|---|---|---|
| Product: | Gentoo Security | Reporter: | Sune Kloppenborg Jeppesen (RETIRED) <jaervosz> |
| Component: | Vulnerabilities | Assignee: | Gentoo Security <security> |
| Status: | RESOLVED FIXED | ||
| Severity: | normal | CC: | net-mail+disabled |
| Priority: | High | ||
| Version: | unspecified | ||
| Hardware: | All | ||
| OS: | Linux | ||
| URL: | https://developer.berlios.de/project/shownotes.php?group_id=1824&release_id=11977 | ||
| Whiteboard: | B3 [glsa] vorlon | ||
| Package list: | Runtime testing required: | --- | |
|
Description
Sune Kloppenborg Jeppesen (RETIRED)
2007-01-06 14:14:41 UTC
And another issue as well: fetchmail-SA-2006-02: TLS enforcement problem/MITM attack/password exposure Topics: fetchmail cannot enforce TLS Author: Matthias Andree Version: 1.0 Announced: 2007-01-04 Type: secret information disclosure Impact: fetchmail can expose cleartext password over unsecure link fetchmail may not detect man in the middle attacks Danger: medium Credits: Isaac Wilcox (bug report, testing, collaboration on fix) CVE Name: CVE-2006-5867 URL: http://fetchmail.berlios.de/fetchmail-SA-2006-02.txt Project URL: http://fetchmail.berlios.de/ Affects: fetchmail releases <= 6.3.5 fetchmail release candidates 6.3.6-rc1, -rc2, -rc3 Not affected: fetchmail release candidates 6.3.6-rc4, -rc5 fetchmail release 6.3.6 Corrected: 2006-11-26 fetchmail 6.3.6-rc4 0. Release history ================== 2006-11-16 v0.01 internal review draft 2006-11-26 v0.02 revise failure cases, workaround, add acknowledgments 2006-11-27 v0.03 add more vulnerabilities 2006-01-04 v1.0 ready for release 1. Background ============= fetchmail is a software package to retrieve mail from remote POP2, POP3, IMAP, ETRN or ODMR servers and forward it to local SMTP, LMTP servers or message delivery agents. fetchmail ships with a graphical, Python/Tkinter based configuration utility named "fetchmailconf" to help the user create configuration (run control) files for fetchmail. 2. Problem description and Impact ================================= Fetchmail has had several nasty password disclosure vulnerabilities for a long time. It was only recently that these have been found. V1. sslcertck/sslfingerprint options should have implied "sslproto tls1" in order to enforce TLS negotiation, but did not. V2. Even with "sslproto tls1" in the config, fetches would go ahead in plain text if STLS/STARTTLS wasn't available (not advertised, or advertised but rejected). V3. POP3 fetches could completely ignore all TLS options whether available or not because it didn't reliably issue CAPA before checking for STLS support - but CAPA is a requisite for STLS. Whether or not CAPAbilities were probed, depended on the "auth" option. (Fetchmail only tried CAPA if the auth option was not set at all, was set to gssapi, kerberos, kerberos_v4, otp, or cram-md5.) V4. POP3 could fall back to using plain text passwords, even if strong authentication had been configured. V5. POP2 would not complain if strong authentication or TLS had been requested. This can cause eavesdroppers to obtain the password, depending on the authentication scheme that is configured or auto-selected, and subsequently impersonate somebody else when logging into the upstream server. 3. Workaround ============= If your upstream offers SSLv3-wrapped service on a dedicated port, use fetchmail --ssl --sslcertck --sslproto ssl3 on the command line, or equivalent in the run control file. This encrypts the whole session. 4. Solution =========== Download and install fetchmail 6.3.6 or a newer stable release from fetchmail's project site at <http://developer.berlios.de/project/showfiles.php?group_id=1824>. 5. Acknowledgments ================== Isaac Wilcox has been a great help with testing the fixes and getting them right. A. Copyright, License and Warranty ================================== (C) Copyright 2007 by Matthias Andree, <matthias.andree@gmx.de>. Some rights reserved. This work is licensed under the Creative Commons Attribution-NonCommercial-NoDerivs German License. To view a copy of this license, visit http://creativecommons.org/licenses/by-nc-nd/2.0/de/ or send a letter to Creative Commons; 559 Nathan Abbott Way; Stanford, California 94305; USA. THIS WORK IS PROVIDED FREE OF CHARGE AND WITHOUT ANY WARRANTIES. Use the information herein at your own risk. END OF fetchmail-SA-2006-02.txt 6.3.6 is in the tree already: 06 Jan 2007; Andrej Kacian <ticho@gentoo.org> +fetchmail-6.3.6.ebuild: Version bump. arches, please test net-mail/fetchmail-6.3.6 and mark stable if possible Stable for HPPA. Stable on Alpha and IA64. x86 stable sparc stable. stable on amd64 ppc stable ppc64 stable now that was quick stable marking... security, please vote on GLSA i vote no: isn't it a client-side DoS? Some client side DoSes are evil. Though I tend to vote NO on this one. padawan vote YES, because of the second issue - that's like telling someone they are using ssh and then using telnet if SSH fails ... silently. People need to know about that and upgrade. The DoS is minor, although fetchamil can run in a system-wide daemon mode that might be affected, i would vote NO if it was just this, but as Matt says, I think the second issue is enough for a YES. 2 yes -> [glsa] it's your fault Matt and Tavis, please write the draft yourself :) Stable on MIPS. s390 was also marked stable. Removing and Closing. thanks Alexander, but please don't close that bug since the GLSA is not sent yet. this is GLSA 200701-13 thanks everyone |