- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory                           GLSA 200403-10
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                                             https://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

  Severity: Normal
     Title: Fetchmail 6.2.5 fixes a remote DoS
      Date: March 30, 2004
      Bugs: #37717
        ID: 200403-10

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
=======
Fetchmail versions 6.2.4 and earlier can be crashed by sending a
specially-crafted email to a fetchmail user.

Background
=========
Fetchmail is a utility that retrieves and forwards mail from remote
systems using IMAP, POP, and other protocols.

Affected packages
================
    -------------------------------------------------------------------
     Package             /   Vulnerable   /                 Unaffected
    -------------------------------------------------------------------
     net-mail/fetchmail       <= 6.2.4                        >= 6.2.5

Description
==========
Fetchmail versions 6.2.4 and earlier can be crashed by sending a
specially-crafted email to a fetchmail user. This problem occursbecause Fetchmail does not properly allocate memory for long lines in
an incoming email.

Impact
=====
Fetchmail users who receive a malicious email may have their fetchmail
program crash.

Workaround
=========
While a workaround is not currently known for this issue, all users are
advised to upgrade to the latest version of the affected package.

Resolution
=========
Fetchmail users should upgrade to version 6.2.5 or later:

    # emerge sync
    # emerge -pv ">=net-mail/fetchmail-6.2.5"
    # emerge ">=net-mail/fetchmail-6.2.5"

References
=========
  [ 1 ]   [ 2 ] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0792

Concerns?
========
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
https://bugs.gentoo.org/.