[Full-disclosure] [SECURITY] [DSA 900-2] New fetchmail packages fix potential information leak

From: Martin Schulze (joey_at_infodrom.org)
Date: 11/21/05

  • Next message: Petko Petkov: "Re: [Full-disclosure] Re: Google Base" 
    Date: Mon, 21 Nov 2005 10:14:03 +0100 (CET)
To: debian-security-announce@lists.debian.org (Debian Security Announcements)

    -----BEGIN PGP SIGNED MESSAGE-----
    Hash: SHA1

    - --------------------------------------------------------------------------
    Debian Security Advisory DSA 900-2 security@debian.org
    http://www.debian.org/security/ Martin Schulze
    November 21st, 2005 http://www.debian.org/security/faq
    - --------------------------------------------------------------------------

    Package : fetchmail
    Vulnerability : programming error
    Problem type : local
    Debian-specific: no
    CVE ID : CVE-2005-3088
    Debian Bug : 336096

    Due to restrictive dependency definition the updated fetchmailconf
    package couldn't be installed on the old stable distribution (woody)
    together with fetchmail-ssl. Hence, this update loosens it, so that
    the update can be pulled in. For completeness we're including the
    original advisory text:

       Thomas Wolff discovered that the fetchmailconfig program which is
       provided as part of fetchmail, an SSL enabled POP3, APOP, IMAP mail
       gatherer/forwarder, creates the new configuration in an insecure
       fashion that can lead to leaking passwords for mail accounts to
       local users.

    This update also fixes a regression in the package for stable caused
    by the last security update.

    For the old stable distribution (woody) this problem has been fixed in
    version 5.9.11-6.4.

    For the stable distribution (sarge) this problem has been fixed in
    version 6.2.5-12sarge3.

    For the unstable distribution (sid) this problem has been fixed in
    version 6.2.5.4-1.

    We recommend that you upgrade your fetchmail package.

    Upgrade Instructions
    - --------------------

    wget url
            will fetch the file for you
    dpkg -i file.deb
            will install the referenced file.

    If you are using the apt-get package manager, use the line for
    sources.list as given below:

    apt-get update
            will update the internal database
    apt-get upgrade
            will install corrected packages

    You may use an automated update by adding the resources from the
    footer to the proper configuration.

    Debian GNU/Linux 3.0 alias woody
    - --------------------------------

      Source archives:

        http://security.debian.org/pool/updates/main/f/fetchmail/fetchmail_5.9.11-6.4.dsc
          Size/MD5 checksum: 712 e1a82c36c542d941d9ab5fddd72a084b
        http://security.debian.org/pool/updates/main/f/fetchmail/fetchmail_5.9.11-6.4.diff.gz
          Size/MD5 checksum: 300946 003692d316f2ff494fe6486c33211490
        http://security.debian.org/pool/updates/main/f/fetchmail/fetchmail_5.9.11.orig.tar.gz
          Size/MD5 checksum: 950273 fff00cbf7be1d01a17605fee23ac96dd

      Architecture independent components:

        http://security.debian.org/pool/updates/main/f/fetchmail/fetchmail-common_5.9.11-6.4_all.deb
          Size/MD5 checksum: 165494 c81bd2391062a87978341feebd8c37b9
        http://security.debian.org/pool/updates/main/f/fetchmail/fetchmailconf_5.9.11-6.4_all.deb
          Size/MD5 checksum: 92860 e6839df03c88066d2512ec2aa15f4409

      Alpha architecture:

        http://security.debian.org/pool/updates/main/f/fetchmail/fetchmail_5.9.11-6.4_alpha.deb
          Size/MD5 checksum: 307132 e726923c5c1fe0466d94fc850011abb8

      ARM architecture:

        http://security.debian.org/pool/updates/main/f/fetchmail/fetchmail_5.9.11-6.4_arm.deb
          Size/MD5 checksum: 290738 d77ba92322089b6616153ec4c7174918

      Intel IA-32 architecture:

        http://security.debian.org/pool/updates/main/f/fetchmail/fetchmail_5.9.11-6.4_i386.deb
          Size/MD5 checksum: 286456 44493842e69d13461215ccf3f005ada2

      Intel IA-64 architecture:

        http://security.debian.org/pool/updates/main/f/fetchmail/fetchmail_5.9.11-6.4_ia64.deb
          Size/MD5 checksum: 329954 ded4883a2870ade58dcc1ca525a76fc9

      HP Precision architecture:

        http://security.debian.org/pool/updates/main/f/fetchmail/fetchmail_5.9.11-6.4_hppa.deb
          Size/MD5 checksum: 299108 a149496bb4e367043440b54faa8f3420

      Motorola 680x0 architecture:

        http://security.debian.org/pool/updates/main/f/fetchmail/fetchmail_5.9.11-6.4_m68k.deb
          Size/MD5 checksum: 281270 79d99ef204a11fc4855cd80c987deba8

      Big endian MIPS architecture:

        http://security.debian.org/pool/updates/main/f/fetchmail/fetchmail_5.9.11-6.4_mips.deb
          Size/MD5 checksum: 296536 5dbce03b1d4c4dafefd2a76865d038d0

      Little endian MIPS architecture:

        http://security.debian.org/pool/updates/main/f/fetchmail/fetchmail_5.9.11-6.4_mipsel.deb
          Size/MD5 checksum: 296000 db69187b67827063291609685c992245

      PowerPC architecture:

        http://security.debian.org/pool/updates/main/f/fetchmail/fetchmail_5.9.11-6.4_powerpc.deb
          Size/MD5 checksum: 291488 8cecaef33456e36256a7498c8ce07556

      IBM S/390 architecture:

        http://security.debian.org/pool/updates/main/f/fetchmail/fetchmail_5.9.11-6.4_s390.deb
          Size/MD5 checksum: 288956 3d5dd68aca0781fdaa64bc600960af46

      Sun Sparc architecture:

        http://security.debian.org/pool/updates/main/f/fetchmail/fetchmail_5.9.11-6.4_sparc.deb
          Size/MD5 checksum: 293594 24741d48693824b9654fe54f28690fd4

      These files will probably be moved into the stable distribution on
      its next update.

    - ---------------------------------------------------------------------------------
    For apt-get: deb http://security.debian.org/ stable/updates main
    For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
    Mailing list: debian-security-announce@lists.debian.org
    Package info: `apt-cache show <pkg>' and http://packages.debian.org/>

    -----BEGIN PGP SIGNATURE-----
    Version: GnuPG v1.4.2 (GNU/Linux)

    iD8DBQFDgY/aW5ql+IAeqTIRAkiuAKCT29H2NQLFBWmTqqNCrvMBlPW6aQCfUynO
    I0XlLd+3EfcgvkLutbt93P8=
    =hMMc
    -----END PGP SIGNATURE-----

    _______________________________________________
    Full-Disclosure - We believe in it.
    Charter:     http://lists.grok.org.uk/full-disclosure-charter.html
    Hosted and sponsored by Secunia - http://secunia.com/

  • Next message: Petko Petkov: "Re: [Full-disclosure] Re: Google Base"

    Relevant Pages