Users login

Create an account »

JOIN XATRIX

Users login

Home » Hacking News » CSSA-2002-027.0-fetchmail imap message count vulnerability

CSSA-2002-027.0-fetchmail imap message count vulnerability

by Nikola Strahija on June 18th, 2002 The fetchmail email client does not properly limit the maximum number of messages available. This allows a remote IMAP server to overwrite memory via a message count that exceeds the boundaries of an array.


2. Vulnerable Supported Versions

System Package
----------------------------------------------------------------------

OpenLinux 3.1.1 Server prior to fetchmail-5.8.17-3.i386.rpm
prior to fetchmailconf-5.8.17-3.i386.rpm

OpenLinux 3.1.1 Workstation prior to fetchmail-5.8.17-3.i386.rpm
prior to fetchmailconf-5.8.17-3.i386.rpm

OpenLinux 3.1 Server prior to fetchmail-5.8.17-3.i386.rpm
prior to fetchmailconf-5.8.17-3.i386.rpm

OpenLinux 3.1 Workstation prior to fetchmail-5.8.17-3.i386.rpm
prior to fetchmailconf-5.8.17-3.i386.rpm


3. Solution

The proper solution is to install the latest packages.


4. OpenLinux 3.1.1 Server

4.1 Package Location

ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1.1/Server/current/RPMS

4.2 Packages

fe2a12a46105337465eaade27dcdfd19 fetchmail-5.8.17-3.i386.rpm
5ee700b144f9888d71760c68af7bdd10 fetchmailconf-5.8.17-3.i386.rpm

4.3 Installation

rpm -Fvh fetchmail-5.8.17-3.i386.rpm
rpm -Fvh fetchmailconf-5.8.17-3.i386.rpm

4.4 Source Package Location

ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1.1/Server/current/SRPMS

4.5 Source Packages

d0baecda18a7f2602fe2b1634463addb fetchmail-5.8.17-3.src.rpm


5. OpenLinux 3.1.1 Workstation

5.1 Package Location

ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1.1/Workstation/current/RPMS

5.2 Packages

e53982b3b4bd650aeca7342b155fd150 fetchmail-5.8.17-3.i386.rpm
66c50c0b2a80a01e5a6b80ee10b999cb fetchmailconf-5.8.17-3.i386.rpm

5.3 Installation

rpm -Fvh fetchmail-5.8.17-3.i386.rpm
rpm -Fvh fetchmailconf-5.8.17-3.i386.rpm

5.4 Source Package Location

ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1.1/Workstation/current/SRPMS

5.5 Source Packages

282f59e2897e214270789b9bd12b1ebe fetchmail-5.8.17-3.src.rpm


6. OpenLinux 3.1 Server

6.1 Package Location

ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1/Server/current/RPMS

6.2 Packages

4e1d00de455d83703ef352b6954a26b5 fetchmail-5.8.17-3.i386.rpm
0d86128975e46e9e739728157e4c8eef fetchmailconf-5.8.17-3.i386.rpm

6.3 Installation

rpm -Fvh fetchmail-5.8.17-3.i386.rpm
rpm -Fvh fetchmailconf-5.8.17-3.i386.rpm

6.4 Source Package Location

ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1/Server/current/SRPMS

6.5 Source Packages

94f1a2221da6db44c31f5562a8935b83 fetchmail-5.8.17-3.src.rpm


7. OpenLinux 3.1 Workstation

7.1 Package Location

ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1/Workstation/current/RPMS

7.2 Packages

7b6142d18892c4a4afe6a956f3a8ae51 fetchmail-5.8.17-3.i386.rpm
6ca58cc1462555b90ff4b5c3a395adb8 fetchmailconf-5.8.17-3.i386.rpm

7.3 Installation

rpm -Fvh fetchmail-5.8.17-3.i386.rpm
rpm -Fvh fetchmailconf-5.8.17-3.i386.rpm

7.4 Source Package Location

ftp://ftp.caldera.com/pub/updates/OpenLinux/3.1/Workstation/current/SRPMS

7.5 Source Packages

296fb5b80dbd73aefffad24b3998f33c fetchmail-5.8.17-3.src.rpm


8. References

Specific references for this advisory:
http://tuxedo.org/~esr/fetchmail/NEWS
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-0146

Caldera security resources:
http://www.caldera.com/support/security/index.html

This security fix closes Caldera incidents sr865008, fz521068,
erg712057.


9. Disclaimer

Caldera International, Inc. is not responsible for the misuse
of any of the information we provide on this website and/or
through our security advisories. Our advisories are a service
to our customers intended to promote secure installation and
use of Caldera products.

______________________________________________________________________________


Newsletter signup

Signup to our monthly newsletter and stay in touch with IT news!

Free E-books

We've got ebooks! But they're not online. :( Please give us a few days to bring downloads back.

Contact

Have something to say or just wanna drop us a line? Please keep this in mind: to spam, we reply with spam.

Contact us »