PT-2008-4156 · Fetchmail+1 · Fetchmail+1

Publicado 2008-06-16 · Atualizado 2021-08-09 · CVE-2008-2711

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions fetchmail versions 6.3.8 and earlier

Description The issue allows remote attackers to cause a denial of service, resulting in a crash and persistent mail failure. This is achieved by sending a malformed mail message with long headers, which triggers an erroneous dereference when using vsnprintf to format log messages. The attack is possible when fetchmail is running in verbose mode.

Recommendations For fetchmail versions 6.3.8 and earlier, avoid running in verbose mode until a fix is available. As a temporary workaround, consider disabling the verbose mode to minimize the risk of exploitation.

Correção

DoS

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2008-2711

RHSA-2009:1427

RHSA-2009_1427

Produtos afetados

Red Hat

Fetchmail

Referências · 33

• https://access.redhat.com/security/cve/CVE-2008-2711 · Nota
• http://mandriva.com/security/advisories?name=MDVSA-2008:117 · Aviso do Fabricante
• http://securitytracker.com/id?1020298 · Nota
• http://secunia.com/advisories/31262 · Aviso do Fabricante
• https://access.redhat.com/security/cve/CVE-2009-2666 · Nota
• http://lists.apple.com/archives/security-announce/2009/Feb/msg00000.html · Aviso do Fabricante
• http://vupen.com/english/advisories/2008/1860/references · Nota
• http://securityfocus.com/bid/29705 · Nota
• http://openwall.com/lists/oss-security/2021/08/09/1 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-2711 · Nota de Segurança
• https://security-tracker.debian.org/tracker/CVE-2008-2711 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/43121 · Nota
• https://issues.rpath.com/browse/RPL-2623 · Nota
• http://secunia.com/advisories/30895 · Aviso do Fabricante
• http://secunia.com/advisories/30742 · Aviso do Fabricante