Red Hat Security Advisory

RHSA-2007:0385

fetchmail security update

Released 2007-06-07 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Desktop version 3 fetchmail-6.2.0-3.el3.4, fetchmail-6.2.0-3.el3.4.i386
Red Hat Enterprise Linux (v. 5 server) fetchmail-6.3.6-1.0.1.el5, fetchmail-6.3.6-1.0.1.el5.i386, fetchmail-6.3.6-1.0.1.el5.ia64 +1
Red Hat Enterprise Linux AS (Advanced Server) version 2.1 fetchmail-5.9.0-21.7.3.el2.1.6, fetchmail-5.9.0-21.7.3.el2.1.6.i386, fetchmail-5.9.0-21.7.3.el2.1.6.ia64 +2
Red Hat Enterprise Linux AS version 3 fetchmail-6.2.0-3.el3.4, fetchmail-6.2.0-3.el3.4.i386, fetchmail-6.2.0-3.el3.4.ia64 +1
Red Hat Enterprise Linux AS version 4 fetchmail-6.2.5-6.0.1.el4, fetchmail-6.2.5-6.0.1.el4.i386, fetchmail-6.2.5-6.0.1.el4.ia64 +1
Red Hat Enterprise Linux Desktop Workstation (v. 5 client) fetchmail-6.3.6-1.0.1.el5, fetchmail-6.3.6-1.0.1.el5.i386
Red Hat Enterprise Linux Desktop version 4 fetchmail-6.2.5-6.0.1.el4, fetchmail-6.2.5-6.0.1.el4.i386
Red Hat Enterprise Linux ES version 2.1 fetchmail-5.9.0-21.7.3.el2.1.6, fetchmail-5.9.0-21.7.3.el2.1.6.i386, fetchmailconf-5.9.0-21.7.3.el2.1.6.i386
Red Hat Enterprise Linux ES version 3 fetchmail-6.2.0-3.el3.4, fetchmail-6.2.0-3.el3.4.i386, fetchmail-6.2.0-3.el3.4.ia64
Red Hat Enterprise Linux ES version 4 fetchmail-6.2.5-6.0.1.el4, fetchmail-6.2.5-6.0.1.el4.i386, fetchmail-6.2.5-6.0.1.el4.ia64
Red Hat Enterprise Linux WS version 2.1 fetchmail-5.9.0-21.7.3.el2.1.6, fetchmail-5.9.0-21.7.3.el2.1.6.i386, fetchmailconf-5.9.0-21.7.3.el2.1.6.i386
Red Hat Enterprise Linux WS version 3 fetchmail-6.2.0-3.el3.4, fetchmail-6.2.0-3.el3.4.i386, fetchmail-6.2.0-3.el3.4.ia64
Red Hat Enterprise Linux WS version 4 fetchmail-6.2.5-6.0.1.el4, fetchmail-6.2.5-6.0.1.el4.i386, fetchmail-6.2.5-6.0.1.el4.ia64
Red Hat Linux Advanced Workstation 2.1 fetchmail-5.9.0-21.7.3.el2.1.6, fetchmail-5.9.0-21.7.3.el2.1.6.ia64, fetchmailconf-5.9.0-21.7.3.el2.1.6.ia64

Fixes 1 record

TI-2007-01500 CVE-2007-1558 · GHSA-jmh6-7c53-fg26

The APOP protocol allows remote attackers to guess the first 3 characters of a password…

LOW 18

The APOP protocol allows remote attackers to guess the first 3 characters of a password via man-in-the-middle (MITM) attacks that use crafted message IDs and MD5 collisions.

CVSS 2.0LOW 2.6 Network No auth Interaction — EPSS 0.02423 Published 2007-04-16 Fixed