- Home
- CVEs with nessus.description==The remote host is affected by the vulnerability described in GLSA-200701-13 (Fetchmail: Denial of Service and password disclosure)
Neil Hoggarth has discovered that when delivering messages to a message delivery agent by means of the 'mda' option, Fetchmail passes a NULL pointer to the ferror() and fflush() functions when refusing a message.
Isaac Wilcox has discovered numerous means of plain-text password disclosure due to errors in secure connection establishment.
Impact :
An attacker could deliver a message via Fetchmail to a message delivery agent configured to refuse the message, and crash the Fetchmail process. SMTP and LMTP delivery modes are not affected by this vulnerability. An attacker could also perform a Man-in-the-Middle attack, and obtain plain-text authentication credentials of users connecting to a Fetchmail process.
Workaround :
There is no known workaround at this time.
Max CVSS | 0 |
Min CVSS | 0 |
Total Count | 2 |
| ID | CVSS | Summary | Last (major) update | Published |
Back to Top
Mark selected
Back to Top