bugtraq - Re: [SECURITY] [DSA 1259-1] New fetchmail packages fix information disclosure

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <m3zm7bwxaj.fsf@merlin.emma.line.org>
Date: Sun, 18 Feb 2007 11:54:44 +0100
From: Matthias Andree <ma+bt@...e-technik.uni-dortmund.de>
To: bugtraq@...urityfocus.com
Subject: Re: [SECURITY] [DSA 1259-1] New fetchmail packages fix information disclosure

Moritz Muehlenhoff wrote:

> --------------------------------------------------------------------------
> Debian Security Advisory DSA 1259-1                    security@...ian.org
> http://www.debian.org/security/                         Moritz Muehlenhoff
> February 14th, 2007                     http://www.debian.org/security/faq
> --------------------------------------------------------------------------
>
> Package        : fetchmail
> Vulnerability  : programming error
> Problem-Type   : remote
> Debian-specific: no
> CVE ID         : CVE-2006-5867
>
> Isaac Wilcox discovered that fetchmail, a popular mail retrieval and
> forwarding utility, insufficiently enforces encryption of connections,
> which might lead to information disclosure.

(Bcc'ing all people mentioned by name.  Note that Bugtraq is moderated.)

JFTR, a clarification to get the credits right:

Isaac Wilcox was perhaps not the first to actually discover this, but he
was the first person to report this to one of the upstream maintainers,
namely Rob Funk.

Isaac Wilcox has also invested a considerable amount of time setting up
a test suite so we could actually find more cases where passwords leaked
than originally thought. This deserves public credit.

Charles Levert had discovered this issue earlier and fixed it with
additional require-TLS patches which he kept on the gna.org website,
unbeknownst to the fetchmail maintainers.

-----                                                               -----
Note my From: address isn't replyable so that I'm not getting five dozen
"I'm not in the office this minute"; "annoy my colleague"; "my mail
system is too broken to know about the envelope concept" spam messages
back from Bugtraq list "users": use matthias dot andree at gmx dot de
instead (after you've rewritten this as a mail address, evidently).
-----                                                               -----

-- 
Matthias Andree