[USN-233-1] fetchmail vulnerability

[Martin Pitt]

===========================================================
Ubuntu Security Notice USN-233-1	   January 02, 2006
fetchmail vulnerability
CVE-2005-4348
===========================================================

A security issue affects the following Ubuntu releases:

Ubuntu 4.10 (Warty Warthog)
Ubuntu 5.04 (Hoary Hedgehog)
Ubuntu 5.10 (Breezy Badger)

The following packages are affected:

fetchmail

The problem can be corrected by upgrading the affected package to
version 6.2.5-8ubuntu2.3 (for Ubuntu 4.10), 6.2.5-12ubuntu1.3 (for
Ubuntu 5.04), or 6.2.5-13ubuntu3.2 (for Ubuntu 5.10).  In general, a
standard system upgrade is sufficient to effect the necessary changes.

Details follow:

Steve Fosdick discovered a remote Denial of Service vulnerability in
fetchmail. When using fetchmail in 'multidrop' mode, a malicious email
server could cause a crash by sending an email without any headers.
Since fetchmail is commonly called automatically (with cron, for
example), this crash could go unnoticed.


Updated packages for Ubuntu 4.10:

  Source archives:

    http://security.ubuntu.com/ubuntu/pool/main/f/fetchmail/fetchmail_6.2.5-12ubuntu1.3.diff.gz
      Size/MD5:   151315 a832d3536f810689cfb51904577afe31
    http://security.ubuntu.com/ubuntu/pool/main/f/fetchmail/fetchmail_6.2.5-12ubuntu1.3.dsc
      Size/MD5:      656 90dd7402e4cec15abe0bf45e6c274503
    http://security.ubuntu.com/ubuntu/pool/main/f/fetchmail/fetchmail_6.2.5.orig.tar.gz
      Size/MD5:  1257376 9956b30139edaa4f5f77c4d0dbd80225

  Architecture independent packages:

    http://security.ubuntu.com/ubuntu/pool/universe/f/fetchmail/fetchmail-ssl_6.2.5-12ubuntu1.3_all.deb
      Size/MD5:    42434 a7ef705546ce8f4e603075f39a6dde4b
    http://security.ubuntu.com/ubuntu/pool/universe/f/fetchmail/fetchmailconf_6.2.5-12ubuntu1.3_all.deb
      Size/MD5:   101538 389cd71986280ab56fcbba0e404604f6

  amd64 architecture (Athlon64, Opteron, EM64T Xeon)

    http://security.ubuntu.com/ubuntu/pool/main/f/fetchmail/fetchmail_6.2.5-12ubuntu1.3_amd64.deb
      Size/MD5:   297028 067506bbeffaadd42306539a4997e370

  i386 architecture (x86 compatible Intel/AMD)

    http://security.ubuntu.com/ubuntu/pool/main/f/fetchmail/fetchmail_6.2.5-12ubuntu1.3_i386.deb
      Size/MD5:   286240 d5c068f89b48562716e016450e2248df

  powerpc architecture (Apple Macintosh G3/G4/G5)

    http://security.ubuntu.com/ubuntu/pool/main/f/fetchmail/fetchmail_6.2.5-12ubuntu1.3_powerpc.deb
      Size/MD5:   296246 544f5b58795c986c7a252cc2e2a8727f

Updated packages for Ubuntu 5.04:

  Source archives:

    http://security.ubuntu.com/ubuntu/pool/main/f/fetchmail/fetchmail_6.2.5-8ubuntu2.3.diff.gz
      Size/MD5:   137257 f0ceaf752282a062c999b384b8b7ff55
    http://security.ubuntu.com/ubuntu/pool/main/f/fetchmail/fetchmail_6.2.5-8ubuntu2.3.dsc
      Size/MD5:      639 85458cbf69ba7f067527d80ac7ceb4b3
    http://security.ubuntu.com/ubuntu/pool/main/f/fetchmail/fetchmail_6.2.5.orig.tar.gz
      Size/MD5:  1257376 9956b30139edaa4f5f77c4d0dbd80225

  Architecture independent packages:

    http://security.ubuntu.com/ubuntu/pool/universe/f/fetchmail/fetchmailconf_6.2.5-8ubuntu2.3_all.deb
      Size/MD5:   101674 8a30c5316f2ea1fcce14b3c36ba370bf

  amd64 architecture (Athlon64, Opteron, EM64T Xeon)

    http://security.ubuntu.com/ubuntu/pool/main/f/fetchmail/fetchmail_6.2.5-8ubuntu2.3_amd64.deb
      Size/MD5:   555760 8d4672ed29e7dbe60d9a4f473158aa61

  i386 architecture (x86 compatible Intel/AMD)

    http://security.ubuntu.com/ubuntu/pool/main/f/fetchmail/fetchmail_6.2.5-8ubuntu2.3_i386.deb
      Size/MD5:   546362 0cbed65c2404592f5e1bd055574fe53b

  powerpc architecture (Apple Macintosh G3/G4/G5)

    http://security.ubuntu.com/ubuntu/pool/main/f/fetchmail/fetchmail_6.2.5-8ubuntu2.3_powerpc.deb
      Size/MD5:   556200 3927a92d2deba7534c5a67bbdecc77fc

Updated packages for Ubuntu 5.10:

  Source archives:

    http://security.ubuntu.com/ubuntu/pool/main/f/fetchmail/fetchmail_6.2.5-13ubuntu3.2.diff.gz
      Size/MD5:   131595 f8ee0c74b53ffb107a8f9b8d9ded75d1
    http://security.ubuntu.com/ubuntu/pool/main/f/fetchmail/fetchmail_6.2.5-13ubuntu3.2.dsc
      Size/MD5:      830 64e499d812a87ad755bcd32b352f2b00
    http://security.ubuntu.com/ubuntu/pool/main/f/fetchmail/fetchmail_6.2.5.orig.tar.gz
      Size/MD5:  1257376 9956b30139edaa4f5f77c4d0dbd80225

  Architecture independent packages:

    http://security.ubuntu.com/ubuntu/pool/universe/f/fetchmail/fetchmail-ssl_6.2.5-13ubuntu3.2_all.deb
      Size/MD5:    42940 7a6644925b26ac82e571c8a191df1d3e
    http://security.ubuntu.com/ubuntu/pool/universe/f/fetchmail/fetchmailconf_6.2.5-13ubuntu3.2_all.deb
      Size/MD5:   102024 36fe4801b83466c7b4aad98fd64505b7

  amd64 architecture (Athlon64, Opteron, EM64T Xeon)

    http://security.ubuntu.com/ubuntu/pool/main/f/fetchmail/fetchmail_6.2.5-13ubuntu3.2_amd64.deb
      Size/MD5:   299512 5b3da4915bcff58587ba8d7f8262a09c

  i386 architecture (x86 compatible Intel/AMD)

    http://security.ubuntu.com/ubuntu/pool/main/f/fetchmail/fetchmail_6.2.5-13ubuntu3.2_i386.deb
      Size/MD5:   286284 bd2eb14e845caaec8f157c5591e7ee5e

  powerpc architecture (Apple Macintosh G3/G4/G5)

    http://security.ubuntu.com/ubuntu/pool/main/f/fetchmail/fetchmail_6.2.5-13ubuntu3.2_powerpc.deb
      Size/MD5:   297134 9b60cdcc559a884589943c136359b336
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 189 bytes
Desc: Digital signature
URL: <https://lists.ubuntu.com/archives/ubuntu-security-announce/attachments/20060102/8e49b134/attachment.sig>