PT-2008-4156 · Fetchmail+1 · Fetchmail+1

Published 2008-06-16 · Updated 2021-08-09 · CVE-2008-2711

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions fetchmail versions 6.3.8 and earlier

Description The issue allows remote attackers to cause a denial of service, resulting in a crash and persistent mail failure. This is achieved by sending a malformed mail message with long headers, which triggers an erroneous dereference when using vsnprintf to format log messages. The attack is possible when fetchmail is running in verbose mode.

Recommendations For fetchmail versions 6.3.8 and earlier, avoid running in verbose mode until a fix is available. As a temporary workaround, consider disabling the verbose mode to minimize the risk of exploitation.

Fix

DoS

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2008-2711

RHSA-2009:1427

RHSA-2009_1427

Affected Products

Red Hat

Fetchmail

References · 33

• http://mandriva.com/security/advisories?name=MDVSA-2008:117 · Vendor Advisory
• http://secunia.com/advisories/31262 · Vendor Advisory
• http://lists.apple.com/archives/security-announce/2009/Feb/msg00000.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-2711 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2008-2711 · Vendor Advisory
• http://secunia.com/advisories/30895 · Vendor Advisory
• http://secunia.com/advisories/30742 · Vendor Advisory
• http://secunia.com/advisories/33937 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2008-2711 · Vendor Advisory
• https://redhat.com/archives/fedora-package-announce/2008-June/msg01091.html · Vendor Advisory
• https://redhat.com/archives/fedora-package-announce/2008-June/msg01095.html · Vendor Advisory
• http://secunia.com/advisories/31287 · Vendor Advisory
• http://slackware.com/security/viewer.php?l=slackware-security&y=2008&m=slackware-security.495740 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2008-2711 · Vendor Advisory
• https://access.redhat.com/security/cve/CVE-2008-2711 · Note