[Security Announce] [ MDVSA-2008:117 ] - Updated fetchmail packages fix DoS vulnerability

[news 28]

This is a multi-part message in MIME format...

 

------------=_1213937739-11275-6436

 

 

-----BEGIN PGP SIGNED MESSAGE-----

Hash: SHA1

 

_______________________________________________________________________

 

Mandriva Linux Security Advisory MDVSA-2008:117

http://www.mandriva.com/security/

_______________________________________________________________________

 

Package : fetchmail

Date : June 19, 2008

Affected: 2007.1, 2008.0, 2008.1, Corporate 3.0, Corporate 4.0

_______________________________________________________________________

 

Problem Description:

 

A flaw in fetchmail was discovered that allowed remote attackers

to cause a denial of service (crash and persistent mail failure)

via a malformed message with long headers. The crash only occured

when fetchmail was called in '-v -v' mode (CVE-2008-2711).

 

The updated packages have been patched to prevent this issue.

_______________________________________________________________________

 

References:

 

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2711

_______________________________________________________________________

 

Updated Packages:

 

Mandriva Linux 2007.1:

77b20fed31ffc8f26b91b289b1735742 2007.1/i586/fetchmail-6.3.6-1.3mdv2007.1.i586.rpm

48d0099eb291e7ed6de0ee268f483be4 2007.1/i586/fetchmailconf-6.3.6-1.3mdv2007.1.i586.rpm

efc2563d1ab82b6d0f32762caefa2439 2007.1/i586/fetchmail-daemon-6.3.6-1.3mdv2007.1.i586.rpm

a208f8c8096e5204fa17f749c369fa4c 2007.1/SRPMS/fetchmail-6.3.6-1.3mdv2007.1.src.rpm

 

Mandriva Linux 2007.1/X86_64:

f9a9f4086f217c01330a39db69976a80 2007.1/x86_64/fetchmail-6.3.6-1.3mdv2007.1.x86_64.rpm

64fbf2cba15a7871884859263832effa 2007.1/x86_64/fetchmailconf-6.3.6-1.3mdv2007.1.x86_64.rpm

826669b445b5107862a07d9b0e75bfb9 2007.1/x86_64/fetchmail-daemon-6.3.6-1.3mdv2007.1.x86_64.rpm

a208f8c8096e5204fa17f749c369fa4c 2007.1/SRPMS/fetchmail-6.3.6-1.3mdv2007.1.src.rpm

 

Mandriva Linux 2008.0:

44bf754420177032e7720aa6385d92dd 2008.0/i586/fetchmail-6.3.8-4.1mdv2008.0.i586.rpm

090719d821a64ebc3ac486bfc1b90363 2008.0/i586/fetchmailconf-6.3.8-4.1mdv2008.0.i586.rpm

836dbd2dda8acb1267bfaedfb342a1b7 2008.0/i586/fetchmail-daemon-6.3.8-4.1mdv2008.0.i586.rpm

67ccd52b855904cdab9c59403ca75144 2008.0/SRPMS/fetchmail-6.3.8-4.1mdv2008.0.src.rpm

 

Mandriva Linux 2008.0/X86_64:

ffd538cbfe8476577c172088e6ab6ccd 2008.0/x86_64/fetchmail-6.3.8-4.1mdv2008.0.x86_64.rpm

bba7c59daafdf2b922fdc49c8289e950 2008.0/x86_64/fetchmailconf-6.3.8-4.1mdv2008.0.x86_64.rpm

5ba2c860cdf76975243aa95f637e5bfa 2008.0/x86_64/fetchmail-daemon-6.3.8-4.1mdv2008.0.x86_64.rpm

67ccd52b855904cdab9c59403ca75144 2008.0/SRPMS/fetchmail-6.3.8-4.1mdv2008.0.src.rpm

 

Mandriva Linux 2008.1:

3183a6eecffd1d3f28cc653d7c1154cb 2008.1/i586/fetchmail-6.3.8-7.1mdv2008.1.i586.rpm

332305442e6617b3c6e8477b8873d671 2008.1/i586/fetchmailconf-6.3.8-7.1mdv2008.1.i586.rpm

64f5cd910f5e25a82eb673fc3e017f7d 2008.1/i586/fetchmail-daemon-6.3.8-7.1mdv2008.1.i586.rpm

b4625b074ae3f30016eca5beedddda85 2008.1/SRPMS/fetchmail-6.3.8-7.1mdv2008.1.src.rpm

 

Mandriva Linux 2008.1/X86_64:

afa1fe93700e16c207b26466c379dba0 2008.1/x86_64/fetchmail-6.3.8-7.1mdv2008.1.x86_64.rpm

38fc1cb8e9b6a838fd7aaac05cbdfd6c 2008.1/x86_64/fetchmailconf-6.3.8-7.1mdv2008.1.x86_64.rpm

96413fc60a0d5c961e69c5ecae03001c 2008.1/x86_64/fetchmail-daemon-6.3.8-7.1mdv2008.1.x86_64.rpm

b4625b074ae3f30016eca5beedddda85 2008.1/SRPMS/fetchmail-6.3.8-7.1mdv2008.1.src.rpm

 

Corporate 3.0:

8ea71c3755960b09d7f24de64d26f8cd corporate/3.0/i586/fetchmail-6.2.5-3.7.C30mdk.i586.rpm

d56338486e23c1b4bed562feaeaa9a7b corporate/3.0/i586/fetchmailconf-6.2.5-3.7.C30mdk.i586.rpm

2a9a1ea5b35a6079de582d4a023263e3 corporate/3.0/i586/fetchmail-daemon-6.2.5-3.7.C30mdk.i586.rpm

9b1b9c5cab6b2c81b11f26b7587aa096 corporate/3.0/SRPMS/fetchmail-6.2.5-3.7.C30mdk.src.rpm

 

Corporate 3.0/X86_64:

84203e2a84ad1772a78ba5b5c9c33a2f corporate/3.0/x86_64/fetchmail-6.2.5-3.7.C30mdk.x86_64.rpm

3d6dbf92ffc9101a765decbe530437c9 corporate/3.0/x86_64/fetchmailconf-6.2.5-3.7.C30mdk.x86_64.rpm

156c24d040be43da88842d5ee27b40ba corporate/3.0/x86_64/fetchmail-daemon-6.2.5-3.7.C30mdk.x86_64.rpm

9b1b9c5cab6b2c81b11f26b7587aa096 corporate/3.0/SRPMS/fetchmail-6.2.5-3.7.C30mdk.src.rpm

 

Corporate 4.0:

1f69a551eb9f1afbbe6e42be597b1ba1 corporate/4.0/i586/fetchmail-6.2.5-11.6.20060mlcs4.i586.rpm

421360e6dee540b9d4e28b274724e604 corporate/4.0/i586/fetchmailconf-6.2.5-11.6.20060mlcs4.i586.rpm

6451f4757de94be5d5a5c8542c8e703b corporate/4.0/i586/fetchmail-daemon-6.2.5-11.6.20060mlcs4.i586.rpm

1c3a942647354d1de2b6abe0253e02b0 corporate/4.0/SRPMS/fetchmail-6.2.5-11.6.20060mlcs4.src.rpm

 

Corporate 4.0/X86_64:

c9101af89574256bba203cd4f7e215c1 corporate/4.0/x86_64/fetchmail-6.2.5-11.6.20060mlcs4.x86_64.rpm

938b40ccf9dcade9edf7347fdd42324b corporate/4.0/x86_64/fetchmailconf-6.2.5-11.6.20060mlcs4.x86_64.rpm

990a1f0e7642ce75a4923a24990b0b68 corporate/4.0/x86_64/fetchmail-daemon-6.2.5-11.6.20060mlcs4.x86_64.rpm

1c3a942647354d1de2b6abe0253e02b0 corporate/4.0/SRPMS/fetchmail-6.2.5-11.6.20060mlcs4.src.rpm

_______________________________________________________________________

 

To upgrade automatically use MandrivaUpdate or urpmi. The verification

of md5 checksums and GPG signatures is performed automatically for you.

 

All packages are signed by Mandriva for security. You can obtain the

GPG public key of the Mandriva Security Team by executing:

 

gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 

You can view other update advisories for Mandriva Linux at:

 

http://www.mandriva.com/security/advisories

 

If you want to report vulnerabilities, please contact

 

security_(at)_mandriva.com

_______________________________________________________________________

 

Type Bits/KeyID Date User ID

pub 1024D/22458A98 2000-07-10 Mandriva Security Team

 

-----BEGIN PGP SIGNATURE-----

Version: GnuPG v1.4.9 (GNU/Linux)

 

iD8DBQFIWwvFmqjQ0CJFipgRAmuMAJ9RKHOnL0QPdrTOCH8N5ws9EHOO3wCg3RXb

xCFh6pZYZPeM9sOT/TVtYDk=

=DIA4

-----END PGP SIGNATURE-----

 

 

------------=_1213937739-11275-6436

Content-Type: text/plain; name="message-footer.txt"

Content-Disposition: inline; filename="message-footer.txt"

Content-Transfer-Encoding: 8bit

 

To unsubscribe, send a email to sympa ( -at -) mandrivalinux.org

with this subject : unsubscribe security-announce

_______________________________________________________

Want to buy your Pack or Services from Mandriva?

Go to http://www.mandrivastore.com

Join the Club : http://www.mandrivaclub.com

_______________________________________________________

 

------------=_1213937739-11275-6436--