MDVSA-2012:149

Nom du paquet
fetchmail
Date
2012-09-01
Advisory ID
MDVSA-2012:149
Affected versions
MES5 i586 , 2011 i586 , MES5 x86_64 , 2011 x86_64

Problem description

Multiple vulnerabilities has been found and corrected in fetchmail:

Fetchmail version 6.3.9 enabled all SSL workarounds (SSL_OP_ALL) which
contains a switch to disable a countermeasure against certain attacks
against block ciphers that permit guessing the initialization vectors,
providing that an attacker can make the application (fetchmail) encrypt
some data for him -- which is not easily the case (aka a BEAST attack)
(CVE-2011-3389).

A denial of service flaw was found in the way Fetchmail, a remote mail
retrieval and forwarding utility, performed base64 decoding of certain
NTLM server responses. Upon sending the NTLM authentication request,
Fetchmail did not check if the received response was actually part
of NTLM protocol exchange, or server-side error message and session
abort. A rogue NTML server could use this flaw to cause fetchmail
executable crash (CVE-2012-3482).

This advisory provides the latest version of fetchmail (6.3.22)
which is not vulnerable to these issues.

Updated packages

MES5 i586

 8baa56904b83b49128b49510e78eb5ca  mes5/i586/fetchmail-6.3.22-0.1mdvmes5.2.i586.rpm
 505d3831e0c319f8869994ee8785df98  mes5/i586/fetchmailconf-6.3.22-0.1mdvmes5.2.i586.rpm
 4d494a41525dc93ba0ec0938a9e8c0a1  mes5/i586/fetchmail-daemon-6.3.22-0.1mdvmes5.2.i586.rpm 
 244ec881f39b978004b3a2c148c4379a  mes5/SRPMS/fetchmail-6.3.22-0.1mdvmes5.2.src.rpm

2011 i586

 70875792da1b3364cc35eafbf803720a  2011/i586/fetchmail-6.3.22-0.1-mdv2011.0.i586.rpm
 10a80277160da304e4cd1d1716af8af1  2011/i586/fetchmailconf-6.3.22-0.1-mdv2011.0.i586.rpm
 0a06b35a176703c84f59042463c58257  2011/i586/fetchmail-daemon-6.3.22-0.1-mdv2011.0.i586.rpm 
 908499180e7bd8ce77c5aa0cfb45f5f4  2011/SRPMS/fetchmail-6.3.22-0.1.src.rpm

MES5 x86_64

 470d43ce1b232f3e1976607a56e22da1  mes5/x86_64/fetchmail-6.3.22-0.1mdvmes5.2.x86_64.rpm
 ddf8fb8d0a9543d92803ef20aeb175d1  mes5/x86_64/fetchmailconf-6.3.22-0.1mdvmes5.2.x86_64.rpm
 b1bc07da8fe90f923b9353306f4bb9fe  mes5/x86_64/fetchmail-daemon-6.3.22-0.1mdvmes5.2.x86_64.rpm 
 244ec881f39b978004b3a2c148c4379a  mes5/SRPMS/fetchmail-6.3.22-0.1mdvmes5.2.src.rpm

2011 x86_64

 3fbfd18fd97b80c487d49027a8e866c2  2011/x86_64/fetchmail-6.3.22-0.1-mdv2011.0.x86_64.rpm
 dfaaadff76dcb1d559de6bdcba975832  2011/x86_64/fetchmailconf-6.3.22-0.1-mdv2011.0.x86_64.rpm
 faac11439dfa603e7999c37ced006ebf  2011/x86_64/fetchmail-daemon-6.3.22-0.1-mdv2011.0.x86_64.rpm 
 908499180e7bd8ce77c5aa0cfb45f5f4  2011/SRPMS/fetchmail-6.3.22-0.1.src.rpm

References