National Cyber-Alert System

Vulnerability Summary for CVE-2006-0321

Overview

fetchmail 6.3.0 and other versions before 6.3.2 allows remote attackers to cause a denial of service (crash) via crafted e-mail messages that cause a free of an invalid pointer when fetchmail bounces the message to the originator or local postmaster.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

Vendor Statements (disclaimer)

Official Statement from Red Hat (08/30/2006)

This issue did not affect the versions of Fetchmail as distributed with Red Hat Enterprise Linux 2.1, 3, or 4.

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

US-CERT Technical Alert: TA06-214A

Name: TA06-214A

Hyperlink:http://www.us-cert.gov/cas/techalerts/TA06-214A.html

External Source: CONFIRM

Name: http://fetchmail.berlios.de/fetchmail-SA-2006-01.txt

Type: Advisory; Patch Information

Hyperlink:http://fetchmail.berlios.de/fetchmail-SA-2006-01.txt

External Source: XF

Name: fetchmail-message-bounce-dos(24265)

Hyperlink:http://xforce.iss.net/xforce/xfdb/24265

External Source: VUPEN

Name: ADV-2006-3101

Hyperlink:http://www.vupen.com/english/advisories/2006/3101

External Source: VUPEN

Name: ADV-2006-0300

Hyperlink:http://www.vupen.com/english/advisories/2006/0300

External Source: BID

Name: 19289

Hyperlink:http://www.securityfocus.com/bid/19289

External Source: BID

Name: 16365

Hyperlink:http://www.securityfocus.com/bid/16365

External Source: BUGTRAQ

Name: 20060122 fetchmail security announcement fetchmail-SA-2006-01 (CVE-2006-0321)

Hyperlink:http://www.securityfocus.com/archive/1/archive/1/422936/100/0/threaded

External Source: OSVDB

Name: 22691

Hyperlink:http://www.osvdb.org/22691

External Source: SLACKWARE

Name: SSA:2006-045-01

Hyperlink:http://slackware.com/security/viewer.php?l=slackware-security&y=2006&m=slackware-security.443499

External Source: SECTRACK

Name: 1015527

Hyperlink:http://securitytracker.com/id?1015527

External Source: SECUNIA

Name: 21253

Type: Advisory

Hyperlink:http://secunia.com/advisories/21253

External Source: SECUNIA

Name: 18895

Type: Advisory

Hyperlink:http://secunia.com/advisories/18895

External Source: SECUNIA

Name: 18571

Type: Advisory

Hyperlink:http://secunia.com/advisories/18571

External Source: APPLE

Name: APPLE-SA-2006-08-01

Hyperlink:http://lists.apple.com/archives/security-announce/2006//Aug/msg00000.html

External Source: CONFIRM

Name: http://developer.berlios.de/project/shownotes.php?release_id=8784

Hyperlink:http://developer.berlios.de/project/shownotes.php?release_id=8784

External Source: CONFIRM

Name: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=348747

Hyperlink:http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=348747