Oval Definition:oval:org.mitre.oval:def:13759
Revision Date:2011-11-21Version:19
Title:DSA-1852-1 fetchmail -- insufficient input validation
Description:It was discovered that fetchmail, a full-featured remote mail retrieval and forwarding utility, is vulnerable to the "Null Prefix Attacks Against SSL/TLS Certificates" recently published at the Blackhat conference. This allows an attacker to perform undetected man-in-the-middle attacks via a crafted ITU-T X.509 certificate with an injected null byte in the subjectAltName or Common Name fields. Note, as a fetchmail user you should always use strict certificate validation through either these option combinations: sslcertck ssl sslproto ssl3 or sslcertck sslproto tls1 For the oldstable distribution , this problem has been fixed in version 6.3.6-1etch2. For the stable distribution , this problem has been fixed in version 6.3.9~rc2-4+lenny1. For the testing distribution , this problem will be fixed soon. For the unstable distribution , this problem has been fixed in version 6.3.9~rc2-6. We recommend that you upgrade your fetchmail packages.
Family:unixClass:patch
Status:ACCEPTEDReference(s):DSA-1852-1
Platform(s):Debian 4.0
Debian 5.0
Product(s):fetchmail
Definition Synopsis
  • Release section
  • Debian GNU/Linux 5.0 is installed
  • AND Architecture section
  • Architecture independent section
  • Installed architecture is all
  • AND fetchmailconf DPKG is earlier than 6.3.9~rc2-4+lenny1
  • OR Architecture depended section
  • Supported architectures section
  • Installed architecture is s390
  • OR Installed architecture is amd64
  • OR Installed architecture is sparc
  • OR Installed architecture is arm
  • OR Installed architecture is i386
  • OR Installed architecture is armel
  • OR Installed architecture is mips
  • OR Installed architecture is ia64
  • OR Installed architecture is alpha
  • OR Installed architecture is powerpc
  • OR Installed architecture is mipsel
  • OR Installed architecture is hppa
  • AND Packages section
  • fetchmail DPKG is earlier than 6.3.9~rc2-4+lenny1
  • OR Release section
  • Debian GNU/Linux 4.0 is installed.
  • AND Architecture section
  • Architecture independent section
  • Installed architecture is all
  • AND fetchmailconf DPKG is earlier than 6.3.6-1etch2
  • OR Architecture depended section
  • Supported architectures section
  • Installed architecture is s390
  • OR Installed architecture is amd64
  • OR Installed architecture is sparc
  • OR Installed architecture is arm
  • OR Installed architecture is i386
  • OR Installed architecture is ia64
  • OR Installed architecture is alpha
  • OR Installed architecture is powerpc
  • OR Installed architecture is hppa
  • AND Packages section
  • fetchmail DPKG is earlier than 6.3.6-1etch2
  • BACK