| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Thu, 11 Jan 2007 12:52:06 -0800
From: Kees Cook <kees@...ntu.com>
To: ubuntu-security-announce@...ts.ubuntu.com
Cc: full-disclosure@...ts.grok.org.uk, bugtraq@...urityfocus.com
Subject: [USN-405-1] fetchmail vulnerability
===========================================================
Ubuntu Security Notice USN-405-1 January 11, 2007
fetchmail vulnerability
CVE-2006-5867
===========================================================
A security issue affects the following Ubuntu releases:
Ubuntu 5.10
Ubuntu 6.06 LTS
Ubuntu 6.10
This advisory also applies to the corresponding versions of
Kubuntu, Edubuntu, and Xubuntu.
The problem can be corrected by upgrading your system to the
following package versions:
Ubuntu 5.10:
fetchmail 6.2.5-13ubuntu3.3
Ubuntu 6.06 LTS:
fetchmail 6.3.2-2ubuntu2.1
Ubuntu 6.10:
fetchmail 6.3.4-1ubuntu4.1
In general, a standard system upgrade is sufficient to effect the
necessary changes.
Details follow:
It was discovered that fetchmail did not correctly require TLS
negotiation in certain situations. This would result in a user's
unencrypted password being sent across the network.
If fetchmail has been configured to use the "sslproto tls1",
"sslcertck", or "sslfingerprint" options with a server that does not
correctly support TLS negotiation, this update may cause fetchmail to
(correctly) abort authentication.
Updated packages for Ubuntu 5.10:
Source archives:
http://security.ubuntu.com/ubuntu/pool/main/f/fetchmail/fetchmail_6.2.5-13ubuntu3.3.diff.gz
Size/MD5: 136261 57185837a58d3ad514c6bc4c2b230b74
http://security.ubuntu.com/ubuntu/pool/main/f/fetchmail/fetchmail_6.2.5-13ubuntu3.3.dsc
Size/MD5: 830 492f64454fbf955851ef89e7f0e53c81
http://security.ubuntu.com/ubuntu/pool/main/f/fetchmail/fetchmail_6.2.5.orig.tar.gz
Size/MD5: 1257376 9956b30139edaa4f5f77c4d0dbd80225
Architecture independent packages:
http://security.ubuntu.com/ubuntu/pool/universe/f/fetchmail/fetchmail-ssl_6.2.5-13ubuntu3.3_all.deb
Size/MD5: 43036 6a77a66efc96d0a88403d0359a2a5112
http://security.ubuntu.com/ubuntu/pool/universe/f/fetchmail/fetchmailconf_6.2.5-13ubuntu3.3_all.deb
Size/MD5: 102122 2c5f8b5d6d626a60524f908316d618dc
amd64 architecture (Athlon64, Opteron, EM64T Xeon)
http://security.ubuntu.com/ubuntu/pool/main/f/fetchmail/fetchmail_6.2.5-13ubuntu3.3_amd64.deb
Size/MD5: 300240 e789b1f9a34c4e635199912c2d916b3b
i386 architecture (x86 compatible Intel/AMD)
http://security.ubuntu.com/ubuntu/pool/main/f/fetchmail/fetchmail_6.2.5-13ubuntu3.3_i386.deb
Size/MD5: 286718 b937c39d14324ff83a00c8fd28c900a5
powerpc architecture (Apple Macintosh G3/G4/G5)
http://security.ubuntu.com/ubuntu/pool/main/f/fetchmail/fetchmail_6.2.5-13ubuntu3.3_powerpc.deb
Size/MD5: 297662 7b62818f6db2c6aecefd47a5ec14628e
sparc architecture (Sun SPARC/UltraSPARC)
http://security.ubuntu.com/ubuntu/pool/main/f/fetchmail/fetchmail_6.2.5-13ubuntu3.3_sparc.deb
Size/MD5: 291154 aa7114c992431cf599ae3be87fb5b897
Updated packages for Ubuntu 6.06 LTS:
Source archives:
http://security.ubuntu.com/ubuntu/pool/main/f/fetchmail/fetchmail_6.3.2-2ubuntu2.1.diff.gz
Size/MD5: 185979 5e8ebca4a911c900d43829fe62ef805c
http://security.ubuntu.com/ubuntu/pool/main/f/fetchmail/fetchmail_6.3.2-2ubuntu2.1.dsc
Size/MD5: 766 7edfd439359d5a165c06ed1d100f1153
http://security.ubuntu.com/ubuntu/pool/main/f/fetchmail/fetchmail_6.3.2.orig.tar.gz
Size/MD5: 1522264 a661735496077232acedb82a901fa499
Architecture independent packages:
http://security.ubuntu.com/ubuntu/pool/universe/f/fetchmail/fetchmailconf_6.3.2-2ubuntu2.1_all.deb
Size/MD5: 114724 6460745fd92aa99eee0805b23352297c
amd64 architecture (Athlon64, Opteron, EM64T Xeon)
http://security.ubuntu.com/ubuntu/pool/main/f/fetchmail/fetchmail_6.3.2-2ubuntu2.1_amd64.deb
Size/MD5: 346092 b810bc5d0fcf9b387effad1c0e8760a5
i386 architecture (x86 compatible Intel/AMD)
http://security.ubuntu.com/ubuntu/pool/main/f/fetchmail/fetchmail_6.3.2-2ubuntu2.1_i386.deb
Size/MD5: 332450 71eba23c7e1565b4b93d2c7c11b61b60
powerpc architecture (Apple Macintosh G3/G4/G5)
http://security.ubuntu.com/ubuntu/pool/main/f/fetchmail/fetchmail_6.3.2-2ubuntu2.1_powerpc.deb
Size/MD5: 344830 b4296f610b45ab5a3c7161e1a7cf3ac1
sparc architecture (Sun SPARC/UltraSPARC)
http://security.ubuntu.com/ubuntu/pool/main/f/fetchmail/fetchmail_6.3.2-2ubuntu2.1_sparc.deb
Size/MD5: 338824 c8813e761b034117d1d88803c3474c0a
Updated packages for Ubuntu 6.10:
Source archives:
http://security.ubuntu.com/ubuntu/pool/main/f/fetchmail/fetchmail_6.3.4-1ubuntu4.1.diff.gz
Size/MD5: 49974 d00d6feefb5a28806d41f6120ed575ac
http://security.ubuntu.com/ubuntu/pool/main/f/fetchmail/fetchmail_6.3.4-1ubuntu4.1.dsc
Size/MD5: 765 d96f92b7d60ff72be06ad66d94de0341
http://security.ubuntu.com/ubuntu/pool/main/f/fetchmail/fetchmail_6.3.4.orig.tar.gz
Size/MD5: 1313880 023a27d8281e5362323dec3e1ccca1c8
Architecture independent packages:
http://security.ubuntu.com/ubuntu/pool/universe/f/fetchmail/fetchmailconf_6.3.4-1ubuntu4.1_all.deb
Size/MD5: 59994 11dcd228b664fb352dad1f5b1e0d859b
amd64 architecture (Athlon64, Opteron, EM64T Xeon)
http://security.ubuntu.com/ubuntu/pool/main/f/fetchmail/fetchmail_6.3.4-1ubuntu4.1_amd64.deb
Size/MD5: 350382 ca2dd427a85136b8071ddcd55706ccfd
i386 architecture (x86 compatible Intel/AMD)
http://security.ubuntu.com/ubuntu/pool/main/f/fetchmail/fetchmail_6.3.4-1ubuntu4.1_i386.deb
Size/MD5: 341088 e89b64411efda4a1ad7148cab8a0d3a9
powerpc architecture (Apple Macintosh G3/G4/G5)
http://security.ubuntu.com/ubuntu/pool/main/f/fetchmail/fetchmail_6.3.4-1ubuntu4.1_powerpc.deb
Size/MD5: 349512 fff474018dd4bf4e87ed4664047bf663
sparc architecture (Sun SPARC/UltraSPARC)
http://security.ubuntu.com/ubuntu/pool/main/f/fetchmail/fetchmail_6.3.4-1ubuntu4.1_sparc.deb
Size/MD5: 344622 291a00bf5b19cd0256d1baf143798f3e
Download attachment "signature.asc" of type "application/pgp-signature" (190 bytes)
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
Powered by blists - more mailing lists