Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 160463 - net-mail/fetchmail DoS issue (CVE-2006-5867 CVE-2006-5974)
Summary: net-mail/fetchmail DoS issue (CVE-2006-5867 CVE-2006-5974)
Status: RESOLVED FIXED
Alias: None
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: High normal (vote)
Assignee: Gentoo Security
URL: https://developer.berlios.de/project/...
Whiteboard: B3 [glsa] vorlon
Keywords:
Depends on:
Blocks:
 
Reported: 2007-01-06 14:14 UTC by Sune Kloppenborg Jeppesen
Modified: 2007-01-22 22:21 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Sune Kloppenborg Jeppesen gentoo-dev 2007-01-06 14:14:41 UTC
fetchmail-SA-2006-03: crash when refusing message delivered through MDA

Topics:		fetchmail crashes when refusing a message bound for an MDA

Author:		Matthias Andree
Version:	1.0
Announced:	2007-01-04
Type:		denial of service
Impact:		fetchmail aborts prematurely
Danger:		low
Credits:	Neil Hoggarth (bug report and analysis)
CVE Name:	CVE-2006-5974
URL:		http://fetchmail.berlios.de/fetchmail-SA-2006-03.txt
Project URL:	http://fetchmail.berlios.de/

Affects:	fetchmail release = 6.3.5
		fetchmail release candidates 6.3.6-rc1, -rc2

Not affected:	fetchmail release 6.3.6

Corrected:	2006-11-14 fetchmail SVN


0. Release history
==================

2006-11-19 -	internal review draft
2007-01-04 1.0	 ready for release


1. Background
=============

fetchmail is a software package to retrieve mail from remote POP2, POP3,
IMAP, ETRN or ODMR servers and forward it to local SMTP, LMTP servers or
message delivery agents.

fetchmail ships with a graphical, Python/Tkinter based configuration
utility named "fetchmailconf" to help the user create configuration (run
control) files for fetchmail.


2. Problem description and Impact
=================================

Fetchmail 6.3.5 and early 6.3.6 release candidates, when delivering
messages to a message delivery agent by means of the "mda" option, can
crash (by passing a NULL pointer to ferror() and fflush()) when refusing
a message. SMTP and LMTP delivery modes aren't affected.


3. Workaround
=============

Avoid the mda option and ship to a local SMTP or LMTP server instead.


4. Solution
===========

Download and install fetchmail 6.3.6 or a newer stable release from
fetchmail's project site at
<http://developer.berlios.de/project/showfiles.php?group_id=1824>.



A. Copyright, License and Warranty
==================================

(C) Copyright 2007 by Matthias Andree, <matthias.andree@gmx.de>.
Some rights reserved.

This work is licensed under the Creative Commons
Attribution-NonCommercial-NoDerivs German License. To view a copy of
this license, visit http://creativecommons.org/licenses/by-nc-nd/2.0/de/
or send a letter to Creative Commons; 559 Nathan Abbott Way;
Stanford, California 94305; USA.

THIS WORK IS PROVIDED FREE OF CHARGE AND WITHOUT ANY WARRANTIES.
Use the information herein at your own risk.

END OF fetchmail-SA-2006-03.txt
Comment 1 Sune Kloppenborg Jeppesen gentoo-dev 2007-01-06 14:16:26 UTC
And another issue as well:

fetchmail-SA-2006-02: TLS enforcement problem/MITM attack/password exposure

Topics:		fetchmail cannot enforce TLS

Author:		Matthias Andree
Version:	1.0
Announced:	2007-01-04
Type:		secret information disclosure
Impact:		fetchmail can expose cleartext password over unsecure link
		fetchmail may not detect man in the middle attacks
Danger:		medium
Credits:	Isaac Wilcox (bug report, testing, collaboration on fix)
CVE Name:	CVE-2006-5867
URL:		http://fetchmail.berlios.de/fetchmail-SA-2006-02.txt
Project URL:	http://fetchmail.berlios.de/

Affects:	fetchmail releases <= 6.3.5
		fetchmail release candidates 6.3.6-rc1, -rc2, -rc3

Not affected:	fetchmail release candidates 6.3.6-rc4, -rc5
		fetchmail release 6.3.6

Corrected:	2006-11-26 fetchmail 6.3.6-rc4


0. Release history
==================

2006-11-16	v0.01 internal review draft
2006-11-26	v0.02 revise failure cases, workaround, add acknowledgments
2006-11-27	v0.03 add more vulnerabilities
2006-01-04	v1.0  ready for release


1. Background
=============

fetchmail is a software package to retrieve mail from remote POP2, POP3,
IMAP, ETRN or ODMR servers and forward it to local SMTP, LMTP servers or
message delivery agents.

fetchmail ships with a graphical, Python/Tkinter based configuration
utility named "fetchmailconf" to help the user create configuration (run
control) files for fetchmail.


2. Problem description and Impact
=================================

Fetchmail has had several nasty password disclosure vulnerabilities for
a long time. It was only recently that these have been found.

V1. sslcertck/sslfingerprint options should have implied "sslproto tls1"
    in order to enforce TLS negotiation, but did not.

V2. Even with "sslproto tls1" in the config, fetches would go ahead
    in plain text if STLS/STARTTLS wasn't available (not advertised,
    or advertised but rejected).

V3. POP3 fetches could completely ignore all TLS options whether
    available or not because it didn't reliably issue CAPA before
    checking for STLS support - but CAPA is a requisite for STLS.
    Whether or not CAPAbilities were probed, depended on the "auth"
    option. (Fetchmail only tried CAPA if the auth option was not set at
    all, was set to gssapi, kerberos, kerberos_v4, otp, or cram-md5.)

V4. POP3 could fall back to using plain text passwords, even if strong
    authentication had been configured.

V5. POP2 would not complain if strong authentication or TLS had been
    requested.

This can cause eavesdroppers to obtain the password, depending on the
authentication scheme that is configured or auto-selected, and
subsequently impersonate somebody else when logging into the upstream
server.


3. Workaround
=============

If your upstream offers SSLv3-wrapped service on a dedicated port,
use   fetchmail --ssl --sslcertck --sslproto ssl3   on the command line,
or equivalent in the run control file.  This encrypts the whole session.


4. Solution
===========

Download and install fetchmail 6.3.6 or a newer stable release from
fetchmail's project site at
<http://developer.berlios.de/project/showfiles.php?group_id=1824>.


5. Acknowledgments
==================

Isaac Wilcox has been a great help with testing the fixes and getting
them right.


A. Copyright, License and Warranty
==================================

(C) Copyright 2007 by Matthias Andree, <matthias.andree@gmx.de>.
Some rights reserved.

This work is licensed under the Creative Commons
Attribution-NonCommercial-NoDerivs German License. To view a copy of
this license, visit http://creativecommons.org/licenses/by-nc-nd/2.0/de/
or send a letter to Creative Commons; 559 Nathan Abbott Way;
Stanford, California 94305; USA.

THIS WORK IS PROVIDED FREE OF CHARGE AND WITHOUT ANY WARRANTIES.
Use the information herein at your own risk.

END OF fetchmail-SA-2006-02.txt
Comment 2 Matthias Geerdsen (RETIRED) gentoo-dev 2007-01-08 10:42:34 UTC
6.3.6 is in the tree already:

06 Jan 2007; Andrej Kacian <ticho@gentoo.org> +fetchmail-6.3.6.ebuild:
  Version bump.


arches, please test net-mail/fetchmail-6.3.6 and mark stable if possible
Comment 3 Jeroen Roovers gentoo-dev 2007-01-08 13:49:34 UTC
Stable for HPPA.
Comment 4 Bryan Østergaard (RETIRED) gentoo-dev 2007-01-08 14:40:28 UTC
Stable on Alpha and IA64.
Comment 5 Christian Faulhammer (RETIRED) gentoo-dev 2007-01-08 16:56:34 UTC
x86 stable
Comment 6 Gustavo Zacarias (RETIRED) gentoo-dev 2007-01-08 19:00:24 UTC
sparc stable.
Comment 7 Michael Cummings (RETIRED) gentoo-dev 2007-01-08 19:40:52 UTC
stable on amd64
Comment 8 Tobias Scherbaum (RETIRED) gentoo-dev 2007-01-08 19:58:25 UTC
ppc stable
Comment 9 Markus Rothe (RETIRED) gentoo-dev 2007-01-08 20:52:52 UTC
ppc64 stable
Comment 10 Matthias Geerdsen (RETIRED) gentoo-dev 2007-01-08 21:24:32 UTC
now that was quick stable marking...

security, please vote on GLSA
Comment 11 Raphael Marichez (Falco) (RETIRED) gentoo-dev 2007-01-14 18:01:29 UTC
i vote no: isn't it a client-side DoS?
Comment 12 Sune Kloppenborg Jeppesen gentoo-dev 2007-01-14 18:40:42 UTC
Some client side DoSes are evil. Though I tend to vote NO on this one.
Comment 13 Matt Drew (RETIRED) gentoo-dev 2007-01-14 18:51:59 UTC
padawan vote YES, because of the second issue - that's like telling someone they are using ssh and then using telnet if SSH fails ... silently.  People need to know about that and upgrade.
Comment 14 Tavis Ormandy (RETIRED) gentoo-dev 2007-01-15 00:48:22 UTC
The DoS is minor, although fetchamil can run in a system-wide daemon mode that might be affected, i would vote NO if it was just this, but as Matt says, I think the second issue is enough for a YES.
Comment 15 Raphael Marichez (Falco) (RETIRED) gentoo-dev 2007-01-15 23:32:56 UTC
2 yes -> [glsa]

it's your fault Matt and Tavis, please write the draft yourself :)
Comment 16 Alexander Færøy 2007-01-20 18:30:18 UTC
Stable on MIPS.
s390 was also marked stable. Removing and Closing.
Comment 17 Raphael Marichez (Falco) (RETIRED) gentoo-dev 2007-01-22 11:52:21 UTC
thanks Alexander, but please don't close that bug since the GLSA is not sent yet.
Comment 18 Matthias Geerdsen (RETIRED) gentoo-dev 2007-01-22 22:21:33 UTC
this is GLSA 200701-13

thanks everyone