PT-2012-4748 · Fetchmail+1 · Fetchmail+1

J. Porter Clark + 1 · Published 2012-12-21 · Updated 2024-06-15 · CVE-2012-3482

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:P

Name of the Vulnerable Software and Affected Versions Fetchmail versions 5.0.8 through 6.3.21

Description The issue allows remote NTLM servers to cause a denial of service, resulting in a crash and delayed delivery of inbound mail, via a crafted NTLM response that triggers an out-of-bounds read in the base64 decoder. Additionally, it enables remote NTLM servers to obtain sensitive information from memory via an NTLM Type 2 message with a crafted Target Name structure, which triggers an out-of-bounds read.

Recommendations For Fetchmail versions 5.0.8 through 6.3.21, consider disabling NTLM authentication in debug mode until a patch is available. Restrict access to the base64 decoder function to minimize the risk of exploitation. Avoid using the NTLM authentication protocol with debug mode enabled in the affected Fetchmail versions until the issue is resolved.

Fix

Related Identifiers

CVE-2012-3482

OPENSUSE-SU-2024:10194-1

SUSE-SU-2016:0872-1

SUSE-SU-2016_0872-1

Affected Products

Fetchmail

Suse

References · 26

• https://ubuntu.com/security/CVE-2012-3482 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2016:0872-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-3482 · Security Note
• http://lists.fedoraproject.org/pipermail/package-announce/2012-October/088871.html · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2012-3482 · Security Note
• https://osv.dev/vulnerability/CVE-2012-3482 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10194-1 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2012-October/088836.html · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2012-3482 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2012-3482 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2012-3482 · Vendor Advisory
• http://fetchmail.info/fetchmail-SA-2012-02.txt · Vendor Advisory
• http://seclists.org/oss-sec/2012/q3/232 · Note
• https://lists.suse.com/pipermail/sle-security-updates/2016-March/001966.html · Note
• https://suse.com/security/cve/CVE-2012-3482.html · Note