[UNIX] fetchmail Configuration Information Disclosure
From: SecuriTeam (support_at_securiteam.com)
To: firstname.lastname@example.org Date: 2 Nov 2005 09:16:53 +0200
The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
- - - - - - - - -
fetchmail Configuration Information Disclosure
" <http://fetchmail.berlios.de/> Fetchmail is a full-featured, robust,
well-documented remote-mail retrieval and forwarding utility intended to
be used over on-demand TCP/IP links (such as SLIP or PPP connections). "
fetchmail does not limit the settings file's readability, this allow any
user on the machine obtain to sensitive information.
* fetchmail version 220.127.116.11
* fetchmail version 6.2.5
* fetchmail version 6.2.0
* fetchmailconf version 1.43
* fetchmailconf version 1.43.1
* Fetchmail version 6.2.9-rc6
* fetchmailconf version 1.43.2
* fetchmailconf version 1.49
* fetchmail version 6.3.0
The fetchmailconf program opens the control file, writes the configuration
to it, and only then changes the file's security settings to 0600
(rw-------). As the file, usually contains passwords, not making it
unreadable to other users, can cause a situation where the file can be
used to expose passwords.
Run "umask 077", then run "fetchmailconf" from the same shell. After
fetchmailconf has finished, you can restore your old umask.
The vendor has fixed the issue:
For users of fetchmail-18.104.22.168: Download
For users of fetchmail-6.2.6* or 6.2.9* before 6.2.9-rc6: update to the
latest fetchmail-devel package
The information has been provided by
<mailto:email@example.com> Matthias Andree.
The original article can be found at:
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: firstname.lastname@example.org
In order to subscribe to the mailing list, simply forward this email to: email@example.com
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.