Re: [SECURITY] [DSA 1259-1] New fetchmail packages fix information disclosure

[Matthias Andree <ma+bt () dt e-technik uni-dortmund de>]

Moritz Muehlenhoff wrote:

> --------------------------------------------------------------------------
> Debian Security Advisory DSA 1259-1                    security () debian org
> http://www.debian.org/security/                         Moritz Muehlenhoff
> February 14th, 2007                     http://www.debian.org/security/faq
> --------------------------------------------------------------------------
>
> Package        : fetchmail
> Vulnerability  : programming error
> Problem-Type   : remote
> Debian-specific: no
> CVE ID         : CVE-2006-5867
>
> Isaac Wilcox discovered that fetchmail, a popular mail retrieval and
> forwarding utility, insufficiently enforces encryption of connections,
> which might lead to information disclosure.

(Bcc'ing all people mentioned by name.  Note that Bugtraq is moderated.)

JFTR, a clarification to get the credits right:

Isaac Wilcox was perhaps not the first to actually discover this, but he
was the first person to report this to one of the upstream maintainers,
namely Rob Funk.

Isaac Wilcox has also invested a considerable amount of time setting up
a test suite so we could actually find more cases where passwords leaked
than originally thought. This deserves public credit.

Charles Levert had discovered this issue earlier and fixed it with
additional require-TLS patches which he kept on the gna.org website,
unbeknownst to the fetchmail maintainers.

-----                                                               -----
Note my From: address isn't replyable so that I'm not getting five dozen
"I'm not in the office this minute"; "annoy my colleague"; "my mail
system is too broken to know about the envelope concept" spam messages
back from Bugtraq list "users": use matthias dot andree at gmx dot de
instead (after you've rewritten this as a mail address, evidently).
-----                                                               -----

-- 
Matthias Andree