Rapid7 Vulnerability & Exploit Database

RHSA-2009:1427: fetchmail security update

Back to Search

RHSA-2009:1427: fetchmail security update



Fetchmail is a remote mail retrieval and forwarding utility intended foruse over on-demand TCP/IP links, such as SLIP and PPP connections.It was discovered that fetchmail is affected by the previously published"null prefix attack", caused by incorrect handling of NULL characters inX.509 certificates. If an attacker is able to get a carefully-craftedcertificate signed by a trusted Certificate Authority, the attacker coulduse the certificate during a man-in-the-middle attack and potentiallyconfuse fetchmail into accepting it by mistake. (CVE-2009-2666)A flaw was found in the way fetchmail handles rejections from a remote SMTPserver when sending warning mail to the postmaster. If fetchmail sent awarning mail to the postmaster of an SMTP server and that SMTP serverrejected it, fetchmail could crash. (CVE-2007-4565)A flaw was found in fetchmail. When fetchmail is run in double verbosemode ("-v -v"), it could crash upon receiving certain, malformed mailmessages with long headers. A remote attacker could use this flaw to causea denial of service if fetchmail was also running in daemon mode ("-d").(CVE-2008-2711)Note: when using SSL-enabled services, it is recommended that the fetchmail"--sslcertck" option be used to enforce strict SSL certificate checking.All fetchmail users should upgrade to this updated package, which containsbackported patches to correct these issues. If fetchmail is running indaemon mode, it must be restarted for this update to take effect (use the"fetchmail --quit" command to stop the fetchmail process).


  • redhat-upgrade-fetchmail

With Rapid7 live dashboards, I have a clear view of all the assets on my network, which ones can be exploited, and what I need to do in order to reduce the risk in my environment in real-time. No other tool gives us that kind of value and insight.

– Scott Cheney, Manager of Information Security, Sierra View Medical Center