<<< Date Index >>>     <<< Thread Index >>>

[USN-405-1] fetchmail vulnerability



=========================================================== 
Ubuntu Security Notice USN-405-1           January 11, 2007
fetchmail vulnerability
CVE-2006-5867
===========================================================

A security issue affects the following Ubuntu releases:

Ubuntu 5.10
Ubuntu 6.06 LTS
Ubuntu 6.10

This advisory also applies to the corresponding versions of
Kubuntu, Edubuntu, and Xubuntu.

The problem can be corrected by upgrading your system to the
following package versions:

Ubuntu 5.10:
  fetchmail                                6.2.5-13ubuntu3.3

Ubuntu 6.06 LTS:
  fetchmail                                6.3.2-2ubuntu2.1

Ubuntu 6.10:
  fetchmail                                6.3.4-1ubuntu4.1

In general, a standard system upgrade is sufficient to effect the
necessary changes.

Details follow:

It was discovered that fetchmail did not correctly require TLS 
negotiation in certain situations.  This would result in a user's 
unencrypted password being sent across the network.

If fetchmail has been configured to use the "sslproto tls1", 
"sslcertck", or "sslfingerprint" options with a server that does not 
correctly support TLS negotiation, this update may cause fetchmail to 
(correctly) abort authentication.


Updated packages for Ubuntu 5.10:

  Source archives:

    
http://security.ubuntu.com/ubuntu/pool/main/f/fetchmail/fetchmail_6.2.5-13ubuntu3.3.diff.gz
      Size/MD5:   136261 57185837a58d3ad514c6bc4c2b230b74
    
http://security.ubuntu.com/ubuntu/pool/main/f/fetchmail/fetchmail_6.2.5-13ubuntu3.3.dsc
      Size/MD5:      830 492f64454fbf955851ef89e7f0e53c81
    
http://security.ubuntu.com/ubuntu/pool/main/f/fetchmail/fetchmail_6.2.5.orig.tar.gz
      Size/MD5:  1257376 9956b30139edaa4f5f77c4d0dbd80225

  Architecture independent packages:

    
http://security.ubuntu.com/ubuntu/pool/universe/f/fetchmail/fetchmail-ssl_6.2.5-13ubuntu3.3_all.deb
      Size/MD5:    43036 6a77a66efc96d0a88403d0359a2a5112
    
http://security.ubuntu.com/ubuntu/pool/universe/f/fetchmail/fetchmailconf_6.2.5-13ubuntu3.3_all.deb
      Size/MD5:   102122 2c5f8b5d6d626a60524f908316d618dc

  amd64 architecture (Athlon64, Opteron, EM64T Xeon)

    
http://security.ubuntu.com/ubuntu/pool/main/f/fetchmail/fetchmail_6.2.5-13ubuntu3.3_amd64.deb
      Size/MD5:   300240 e789b1f9a34c4e635199912c2d916b3b

  i386 architecture (x86 compatible Intel/AMD)

    
http://security.ubuntu.com/ubuntu/pool/main/f/fetchmail/fetchmail_6.2.5-13ubuntu3.3_i386.deb
      Size/MD5:   286718 b937c39d14324ff83a00c8fd28c900a5

  powerpc architecture (Apple Macintosh G3/G4/G5)

    
http://security.ubuntu.com/ubuntu/pool/main/f/fetchmail/fetchmail_6.2.5-13ubuntu3.3_powerpc.deb
      Size/MD5:   297662 7b62818f6db2c6aecefd47a5ec14628e

  sparc architecture (Sun SPARC/UltraSPARC)

    
http://security.ubuntu.com/ubuntu/pool/main/f/fetchmail/fetchmail_6.2.5-13ubuntu3.3_sparc.deb
      Size/MD5:   291154 aa7114c992431cf599ae3be87fb5b897

Updated packages for Ubuntu 6.06 LTS:

  Source archives:

    
http://security.ubuntu.com/ubuntu/pool/main/f/fetchmail/fetchmail_6.3.2-2ubuntu2.1.diff.gz
      Size/MD5:   185979 5e8ebca4a911c900d43829fe62ef805c
    
http://security.ubuntu.com/ubuntu/pool/main/f/fetchmail/fetchmail_6.3.2-2ubuntu2.1.dsc
      Size/MD5:      766 7edfd439359d5a165c06ed1d100f1153
    
http://security.ubuntu.com/ubuntu/pool/main/f/fetchmail/fetchmail_6.3.2.orig.tar.gz
      Size/MD5:  1522264 a661735496077232acedb82a901fa499

  Architecture independent packages:

    
http://security.ubuntu.com/ubuntu/pool/universe/f/fetchmail/fetchmailconf_6.3.2-2ubuntu2.1_all.deb
      Size/MD5:   114724 6460745fd92aa99eee0805b23352297c

  amd64 architecture (Athlon64, Opteron, EM64T Xeon)

    
http://security.ubuntu.com/ubuntu/pool/main/f/fetchmail/fetchmail_6.3.2-2ubuntu2.1_amd64.deb
      Size/MD5:   346092 b810bc5d0fcf9b387effad1c0e8760a5

  i386 architecture (x86 compatible Intel/AMD)

    
http://security.ubuntu.com/ubuntu/pool/main/f/fetchmail/fetchmail_6.3.2-2ubuntu2.1_i386.deb
      Size/MD5:   332450 71eba23c7e1565b4b93d2c7c11b61b60

  powerpc architecture (Apple Macintosh G3/G4/G5)

    
http://security.ubuntu.com/ubuntu/pool/main/f/fetchmail/fetchmail_6.3.2-2ubuntu2.1_powerpc.deb
      Size/MD5:   344830 b4296f610b45ab5a3c7161e1a7cf3ac1

  sparc architecture (Sun SPARC/UltraSPARC)

    
http://security.ubuntu.com/ubuntu/pool/main/f/fetchmail/fetchmail_6.3.2-2ubuntu2.1_sparc.deb
      Size/MD5:   338824 c8813e761b034117d1d88803c3474c0a

Updated packages for Ubuntu 6.10:

  Source archives:

    
http://security.ubuntu.com/ubuntu/pool/main/f/fetchmail/fetchmail_6.3.4-1ubuntu4.1.diff.gz
      Size/MD5:    49974 d00d6feefb5a28806d41f6120ed575ac
    
http://security.ubuntu.com/ubuntu/pool/main/f/fetchmail/fetchmail_6.3.4-1ubuntu4.1.dsc
      Size/MD5:      765 d96f92b7d60ff72be06ad66d94de0341
    
http://security.ubuntu.com/ubuntu/pool/main/f/fetchmail/fetchmail_6.3.4.orig.tar.gz
      Size/MD5:  1313880 023a27d8281e5362323dec3e1ccca1c8

  Architecture independent packages:

    
http://security.ubuntu.com/ubuntu/pool/universe/f/fetchmail/fetchmailconf_6.3.4-1ubuntu4.1_all.deb
      Size/MD5:    59994 11dcd228b664fb352dad1f5b1e0d859b

  amd64 architecture (Athlon64, Opteron, EM64T Xeon)

    
http://security.ubuntu.com/ubuntu/pool/main/f/fetchmail/fetchmail_6.3.4-1ubuntu4.1_amd64.deb
      Size/MD5:   350382 ca2dd427a85136b8071ddcd55706ccfd

  i386 architecture (x86 compatible Intel/AMD)

    
http://security.ubuntu.com/ubuntu/pool/main/f/fetchmail/fetchmail_6.3.4-1ubuntu4.1_i386.deb
      Size/MD5:   341088 e89b64411efda4a1ad7148cab8a0d3a9

  powerpc architecture (Apple Macintosh G3/G4/G5)

    
http://security.ubuntu.com/ubuntu/pool/main/f/fetchmail/fetchmail_6.3.4-1ubuntu4.1_powerpc.deb
      Size/MD5:   349512 fff474018dd4bf4e87ed4664047bf663

  sparc architecture (Sun SPARC/UltraSPARC)

    
http://security.ubuntu.com/ubuntu/pool/main/f/fetchmail/fetchmail_6.3.4-1ubuntu4.1_sparc.deb
      Size/MD5:   344622 291a00bf5b19cd0256d1baf143798f3e

Attachment: signature.asc
Description: Digital signature