[UNIX] fetchmail Configuration Information Disclosure

From: SecuriTeam (support_at_securiteam.com)
Date: 11/02/05

  • Next message: SecuriTeam: "[UNIX] PHP Multiple Vulnerabilities (File Upload, parse_str() register_global bypassing, phpinfo XSS)"
    To: list@securiteam.com
    Date: 2 Nov 2005 09:16:53 +0200
    
    

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    The SecuriTeam alerts list - Free, Accurate, Independent.

    Get your security news from a reliable source.
    http://www.securiteam.com/mailinglist.html

    - - - - - - - - -

      fetchmail Configuration Information Disclosure
    ------------------------------------------------------------------------

    SUMMARY

    " <http://fetchmail.berlios.de/> Fetchmail is a full-featured, robust,
    well-documented remote-mail retrieval and forwarding utility intended to
    be used over on-demand TCP/IP links (such as SLIP or PPP connections). "

    fetchmail does not limit the settings file's readability, this allow any
    user on the machine obtain to sensitive information.

    DETAILS

    Vulnerable Systems:
     * fetchmail version 6.2.5.2
     * fetchmail version 6.2.5
     * fetchmail version 6.2.0
     * fetchmailconf version 1.43
     * fetchmailconf version 1.43.1

    Immune Systems:
     * Fetchmail version 6.2.9-rc6
     * fetchmailconf version 1.43.2
     * fetchmailconf version 1.49
     * fetchmail version 6.3.0

    The fetchmailconf program opens the control file, writes the configuration
    to it, and only then changes the file's security settings to 0600
    (rw-------). As the file, usually contains passwords, not making it
    unreadable to other users, can cause a situation where the file can be
    used to expose passwords.

    Workaround:
    Run "umask 077", then run "fetchmailconf" from the same shell. After
    fetchmailconf has finished, you can restore your old umask.

    Vendor Status:
    The vendor has fixed the issue:
    For users of fetchmail-6.2.5.2: Download
    <http://developer.berlios.de/project/showfiles.php?group_id=1824&release_id=6617> fetchmailconf-1.43.2.gz.

    For users of fetchmail-6.2.6* or 6.2.9* before 6.2.9-rc6: update to the
    latest fetchmail-devel package
    <https://developer.berlios.de/project/showfiles.php?group_id=1824>
    6.2.9-rc6.

    CVE Information:
     <http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3088>
    CVE-2005-3088

    ADDITIONAL INFORMATION

    The information has been provided by
    <mailto:ma+nomail@dt.e-technik.uni-dortmund.de> Matthias Andree.
    The original article can be found at:
    <http://fetchmail.berlios.de/fetchmail-SA-2005-02.txt>
    http://fetchmail.berlios.de/fetchmail-SA-2005-02.txt

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.


  • Next message: SecuriTeam: "[UNIX] PHP Multiple Vulnerabilities (File Upload, parse_str() register_global bypassing, phpinfo XSS)"

    Relevant Pages

    • [UNIX] Fetchmail DoS and Code Execution Vulnerabilities (POP3, UID)
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... UIDL) reads the responses returned by the POP3 server into fixed-size ... * fetchmail version 6.2.5.1 ... You can either download a complete tarball of fetchmail-6.2.5.2.tar.gz, ...
      (Securiteam)
    • [UNIX] Fetchmail Bouncing Message DoS
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Fetchmail Bouncing Message DoS ... CVE Information: ...
      (Securiteam)
    • [UNIX] Fetchmail Multidrop DoS
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Fetchmail Multidrop DoS ... fetchmail to crash, effectively causing a DoS. ... The new 6.3.X stable branch has been available since 2005-11-30 and will ...
      (Securiteam)
    • [EXPL] phpBB Remote PHP Code Execution (viewtopic.php 2)
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... The following exploit code utilizes a vulnerability in phpBB to cause ... This bulletin is sent to members of the SecuriTeam mailing list. ... In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages. ...
      (Securiteam)
    • [EXPL] TinyWeb Server DoS Exploit
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... The information in this bulletin is provided "AS IS" without warranty of any kind. ... In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages. ...
      (Securiteam)