Security bugs are reported here via bugzilla

[Elisamuel Resto <samuel AT dragonboricua.net>]

Synopsis
========
Crashes related to local fetchmail-generated warning message is rejected[0]
and when with large log messages when running fetchmail in verbose mode[1].

Background
==========
fetchmail is a software package to retrieve mail from remote POP2, POP3,
IMAP, ETRN or ODMR servers and forward it to local SMTP, LMTP servers or
message delivery agents.

fetchmail ships with a graphical, Python/Tkinter based configuration
utility named "fetchmailconf" to help the user create configuration (run
control) files for fetchmail.

Description
===========
CVE-2007-4565:
fetchmail will generate warning messages in certain circumstances and 
send them to the local postmaster or the user starting it. Such warning 
messages can be generated, for instance, if logging into an upstream 
server fails repeatedly or if messages beyond the size limit (if 
configured, default: no limit) are left on the server.

If this warning message is then refused by the SMTP listener that 
fetchmail is forwarding the message to, fetchmail attempts to 
dereference a NULL pointer when trying to find out if it should allow a 
bounce message to be sent.

This causes fetchmail to crash and not collect further messages until it 
is restarted.

Risk assessment: low. In default configuration, fetchmail will talk 
through the loopback interface, that means to the SMTP server on the same 
computer as it is running on. Otherwise, it will commonly be configured 
to talk to trusted SMTP servers, so a compromise or misconfiguration of 
a trusted or the same computer is required to exploit this problem - 
which usually opens up much easier ways of denying service, or worse.


CVE-2008-2711:
Gunter Nau reported fetchmail crashing on some messages; further
debugging by Petr Uzel and Petr Cerny at Novell/SUSE Czech Republic
dug up that this happened when fetchmail was trying to print, in -v -v
verbose level, headers exceeding 2048 bytes. In this situation,
fetchmail would resize the buffer and fill in further parts of the
message, but forget to reinitialize its va_list typed source pointer,
thus reading data from a garbage address found on the stack at
addresses above the function arguments the caller passed in; usually
that would be the caller's stack frame.

It is unknown whether code can be injected remotely, but given that
the segmentation fault is caused by read accesses, the relevant data
is not under the remote attacker's control and no buffer overrun
situation is present that would allow altering program /flow/, it is
deemed rather unlikely that code can be injected.

Note that the required -vv configuration at hand is both non-default
and also not common in automated (cron job) setups, but usually used
in manual debugging, so not many systems would be affected by the
problem. Nonetheless, in vulnerable configurations, it is remotely
exploitable to effect a denial of service attack.


Affected packages
=================
These vulnerabilities were reported for all versions of fetchmail prior to
(and including) 6.3.8. fetchmail in all grimoires is affected by these
vulnerabilities.

fetchmail has been updated in test, and will soon be in the stable 
grimoire[2].
Be sure to read both[0][1] security advisories to make sure you take all
necessary steps and get informed more in-depth about the vulnerabilities.

Resolution
==========
All fetchmail users should upgrade to the latest available version:
# scribe update
# cast -c fetchmail

If you maintain your own installation of fetchmail ouside of sorcery, there 
are 
patches available from upstream in the security advisories.

References
==========
[0] http://fetchmail.berlios.de/fetchmail-SA-2007-02.txt
[1] http://fetchmail.berlios.de/fetchmail-SA-2008-01.txt
[2] http://bugs.sourcemage.org/show_bug.cgi?id=14609

-- 
Elisamuel Resto <samuel AT dragonboricua.net>
Source Mage General Guru / http://sourcemage.org
GPG ID: 18615F19/1024D   / http://simplysam.us

Attachment: signature.asc
Description: PGP signature