National Cyber Awareness System

Vulnerability Summary for CVE-2008-2711

Overview

fetchmail 6.3.8 and earlier, when running in -v -v (aka verbose) mode, allows remote attackers to cause a denial of service (crash and persistent mail failure) via a malformed mail message with long headers, which triggers an erroneous dereference when using vsnprintf to format log messages.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

Vendor Statements (disclaimer)

Official Statement from Red Hat (09/09/2009)

This issue was addressed in fetchmail packages as shipped in Red Hat Enterprise Linux 3, 4, and 5 via: https://rhn.redhat.com/errata/RHSA-2009-1427.html

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: FEDORA

Name: FEDORA-2008-5800

Hyperlink:https://www.redhat.com/archives/fedora-package-announce/2008-June/msg01095.html

External Source: FEDORA

Name: FEDORA-2008-5789

Hyperlink:https://www.redhat.com/archives/fedora-package-announce/2008-June/msg01091.html

External Source: CONFIRM

Name: https://issues.rpath.com/browse/RPL-2623

Hyperlink:https://issues.rpath.com/browse/RPL-2623

External Source: MISC

Name: https://bugzilla.novell.com/show_bug.cgi?id=354291

Hyperlink:https://bugzilla.novell.com/show_bug.cgi?id=354291

External Source: XF

Name: fetchmail-logmessage-dos(43121)

Hyperlink:http://xforce.iss.net/xforce/xfdb/43121

External Source: VUPEN

Name: ADV-2009-0422

Hyperlink:http://www.vupen.com/english/advisories/2009/0422

External Source: VUPEN

Name: ADV-2008-1860

Hyperlink:http://www.vupen.com/english/advisories/2008/1860/references

External Source: SECTRACK

Name: 1020298

Hyperlink:http://www.securitytracker.com/id?1020298

External Source: BID

Name: 29705

Hyperlink:http://www.securityfocus.com/bid/29705

External Source: BUGTRAQ

Name: 20080729 rPSA-2008-0235-1 fetchmail fetchmailconf

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/494865/100/0/threaded

External Source: BUGTRAQ

Name: 20080617 fetchmail security announcement fetchmail-SA-2008-01 (CVE-2008-2711)

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/493391/100/0/threaded

External Source: MLIST

Name: [oss-security] 20080613 CVE Id Request: fetchmail <= 6.3.8 DoS when logging long headers in -v -v mode

Hyperlink:http://www.openwall.com/lists/oss-security/2008/06/13/1

External Source: MANDRIVA

Name: MDVSA-2008:117

Hyperlink:http://www.mandriva.com/security/advisories?name=MDVSA-2008:117

External Source: CONFIRM

Name: http://www.fetchmail.info/fetchmail-SA-2008-01.txt

Hyperlink:http://www.fetchmail.info/fetchmail-SA-2008-01.txt

External Source: CONFIRM

Name: http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0235

Hyperlink:http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0235

External Source: CONFIRM

Name: http://support.apple.com/kb/HT3438

Hyperlink:http://support.apple.com/kb/HT3438

External Source: SLACKWARE

Name: SSA:2008-210-01

Hyperlink:http://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.495740

External Source: SECUNIA

Name: 33937

Type: Advisory

Hyperlink:http://secunia.com/advisories/33937

External Source: SECUNIA

Name: 31287

Type: Advisory

Hyperlink:http://secunia.com/advisories/31287

External Source: SECUNIA

Name: 31262

Type: Advisory

Hyperlink:http://secunia.com/advisories/31262

External Source: SECUNIA

Name: 30895

Type: Advisory

Hyperlink:http://secunia.com/advisories/30895

External Source: SECUNIA

Name: 30742

Type: Advisory

Hyperlink:http://secunia.com/advisories/30742

External Source: OVAL

Name: oval:org.mitre.oval:def:10950

Hyperlink:http://oval.mitre.org/repository/data/getDef?id=oval:org.mitre.oval:def:10950

External Source: APPLE

Name: APPLE-SA-2009-02-12

Hyperlink:http://lists.apple.com/archives/security-announce/2009/Feb/msg00000.html

References to Check Content

Identifier:oval:org.mitre.oval:def:10950

Check System:http://oval.mitre.org/XMLSchema/oval-definitions-5

Hyperlink:http://oval.mitre.org/repository/data/DownloadDefinition?id=oval:org.mitre.oval:def:10950