Description
fetchmail 6.3.8 and earlier, when running in -v -v (aka verbose) mode, allows remote attackers to cause a denial of service (crash and persistent mail failure) via a malformed mail message with long headers, which triggers an erroneous dereference when using vsnprintf to format log messages.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
n/a n/a
n/aaffected
References
- http://www.vupen.com/english/advisories/2008/1860/references ↗
- http://secunia.com/advisories/31287 ↗
- http://www.securityfocus.com/archive/1/494865/100/0/threaded ↗
- http://www.securitytracker.com/id?1020298 ↗
- http://secunia.com/advisories/33937 ↗
- http://www.securityfocus.com/archive/1/493391/100/0/threaded ↗
- http://secunia.com/advisories/31262 ↗
- http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0235 ↗
- http://support.apple.com/kb/HT3438 ↗
- http://lists.apple.com/archives/security-announce/2009/Feb/msg00000.html ↗
- http://secunia.com/advisories/30895 ↗
- https://www.redhat.com/archives/fedora-package-announce/2008-June/msg01095.html ↗
- https://www.redhat.com/archives/fedora-package-announce/2008-June/msg01091.html ↗
- http://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.495740 ↗
- http://www.fetchmail.info/fetchmail-SA-2008-01.txt ↗
- http://www.vupen.com/english/advisories/2009/0422 ↗
- http://www.securityfocus.com/bid/29705 ↗
- https://issues.rpath.com/browse/RPL-2623 ↗
- https://bugzilla.novell.com/show_bug.cgi?id=354291 ↗
- http://www.mandriva.com/security/advisories?name=MDVSA-2008:117 ↗
- https://exchange.xforce.ibmcloud.com/vulnerabilities/43121 ↗
- http://www.openwall.com/lists/oss-security/2008/06/13/1 ↗
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10950 ↗
- http://secunia.com/advisories/30742 ↗
- http://www.openwall.com/lists/oss-security/2021/08/09/1 ↗