Eric S. Raymond Fetchmail Heap Corruption Vulnerability

Eric S. Raymond Fetchmail Heap Corruption Vulnerability

Solution:
Fetchmail 6.2.0 is not vulnerable to this issue. Users are advised to upgrade to the latest version of Fetchmail.

Gentoo Linux has released an advisory. Users who have installed net-mail/fetchmail-6.1.2 and earlier are urged to update their systems by issuing the following commands:

emerge rsync
emerge fetchmail
emerge clean

OpenPKG has released an advisory (OpenPKG-SA-2002.016) which addresses this issue. Fix information can be found in the attached advisory.

EnGarde Secure Linux has released a security advisory (ESA-20030127-002) which contains fixes. Users are urged to apply the supplied fixes as soon as possible.

Mandrake has released a security advisory (MDKSA-2003:011) containing fixes.

Immunix has released a security advisory (IMNX-2003-7+-023-01) including fixes.

Fixes are available:

Eric Raymond Fetchmail 5.3.3

Debian fetchmailconf_5.3.3-4.3_all.deb
Architecture independent package.
http://security.debian.org/pool/updates/main/f/fetchmail/fetchmailconf _5.3.3-4.3_all.deb

Eric Raymond fetchmail-6.2.0.tar.gz
http://www.tuxedo.org/~esr/fetchmail/fetchmail-6.2.0.tar.gz

Eric Raymond Fetchmail 5.4 .0

Eric Raymond fetchmail-6.2.0.tar.gz
http://www.tuxedo.org/~esr/fetchmail/fetchmail-6.2.0.tar.gz

SCO fetchmail-6.1.0-4.i386.rpm
OpenLinux 3.1.1 Server
ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Server/CSSA-2003-001.0/R PMS/fetchmail-6.1.0-4.i386.rpm

SCO fetchmail-6.1.0-4.i386.rpm
OpenLinux 3.1.1 Workstation
ftp://ftp.sco.com/pub/updates/OpenLinux/3.1.1/Workstation/CSSA-2003-00 1.0/RPMS/fetchmail-6.1.0-4.i386.rpm

SCO fetchmail-6.1.0-4.i386.rpm
OpenLinux 3.1 Server
ftp://ftp.sco.com/pub/updates/OpenLinux/3.1/Server/CSSA-2003-001.0/RPM S/fetchmail-6.1.0-4.i386.rpm

SCO fetchmail-6.1.0-4.i386.rpm
OpenLinux 3.1 Workstation
ftp://ftp.sco.com/pub/updates/OpenLinux/3.1/Workstation/CSSA-2003-001. 0/RPMS/fetchmail-6.1.0-4.i386.rpm

Eric Raymond Fetchmail 5.5

Eric Raymond fetchmail-6.2.0.tar.gz
http://www.tuxedo.org/~esr/fetchmail/fetchmail-6.2.0.tar.gz

Eric Raymond Fetchmail 5.6

Eric Raymond fetchmail-6.2.0.tar.gz
http://www.tuxedo.org/~esr/fetchmail/fetchmail-6.2.0.tar.gz

Eric Raymond Fetchmail 5.6.5

SuSE fetchmail-5.6.5-29.ppc.rpm
ftp://ftp.suse.com/pub/suse/ppc/update/7.1/n1/fetchmail-5.6.5-29.ppc.r pm

SuSE fetchmail-5.6.5-30.alpha.rpm
ftp://ftp.suse.com/pub/suse/axp/update/7.1/n1/fetchmail-5.6.5-30.alpha .rpm

SuSE fetchmail-5.6.5-40.i386.rpm
ftp://ftp.suse.com/pub/suse/i386/update/7.1/n1/fetchmail-5.6.5-40.i386 .rpm

Eric Raymond Fetchmail 5.7

Eric Raymond fetchmail-6.2.0.tar.gz
http://www.tuxedo.org/~esr/fetchmail/fetchmail-6.2.0.tar.gz

Eric Raymond Fetchmail 5.8 .0

Eric Raymond fetchmail-6.2.0.tar.gz
http://www.tuxedo.org/~esr/fetchmail/fetchmail-6.2.0.tar.gz

SuSE fetchmail-5.8.0-78.i386.rpm
ftp://ftp.suse.com/pub/suse/i386/update/7.2/n1/fetchmail-5.8.0-78.i386 .rpm

Eric Raymond Fetchmail 5.9 .0

Eric Raymond fetchmail-6.2.0.tar.gz
http://www.tuxedo.org/~esr/fetchmail/fetchmail-6.2.0.tar.gz

Immunix fetchmail-5.9.0-10_imnx_1.i386.rpm
http://download.immunix.org/ImmunixOS/7+/Updates/RPMS/fetchmail-5.9.0- 10_imnx_1.i386.rpm

Immunix fetchmailconf-5.9.0-10_imnx_1.i386.rpm
http://download.immunix.org/ImmunixOS/7+/Updates/RPMS/fetchmailconf-5. 9.0-10_imnx_1.i386.rpm

RedHat fetchmail-5.9.0-21.6.2.i386.rpm
ftp://updates.redhat.com/6.2/en/os/i386/fetchmail-5.9.0-21.6.2.i386.rp m

RedHat fetchmail-5.9.0-21.7.1.i386.rpm
ftp://updates.redhat.com/7.0/en/os/i386/fetchmail-5.9.0-21.7.1.i386.rp m

RedHat fetchmail-5.9.0-21.7.1.i386.rpm
ftp://updates.redhat.com/7.1/en/os/i386/fetchmail-5.9.0-21.7.1.i386.rp m

RedHat fetchmail-5.9.0-21.7.3.i386.rpm
ftp://updates.redhat.com/7.2/en/os/i386/fetchmail-5.9.0-21.7.3.i386.rp m

RedHat fetchmail-5.9.0-21.7.3.i386.rpm
ftp://updates.redhat.com/7.3/en/os/i386/fetchmail-5.9.0-21.7.3.i386.rp m

RedHat fetchmail-5.9.0-21.7.3.ia64.rpm
ftp://updates.redhat.com/7.2/en/os/ia64/fetchmail-5.9.0-21.7.3.ia64.rp m

RedHat fetchmail-5.9.0-21.8.0.i386.rpm
ftp://updates.redhat.com/8.0/en/os/i386/fetchmail-5.9.0-21.8.0.i386.rp m

RedHat fetchmailconf-5.9.0-21.6.2.i386.rpm
ftp://updates.redhat.com/6.2/en/os/i386/fetchmailconf-5.9.0-21.6.2.i38 6.rpm

RedHat fetchmailconf-5.9.0-21.7.1.i386.rpm
ftp://updates.redhat.com/7.0/en/os/i386/fetchmailconf-5.9.0-21.7.1.i38 6.rpm

RedHat fetchmailconf-5.9.0-21.7.1.i386.rpm
ftp://updates.redhat.com/7.1/en/os/i386/fetchmailconf-5.9.0-21.7.1.i38 6.rpm

RedHat fetchmailconf-5.9.0-21.7.3.i386.rpm
ftp://updates.redhat.com/7.2/en/os/i386/fetchmailconf-5.9.0-21.7.3.i38 6.rpm

RedHat fetchmailconf-5.9.0-21.7.3.i386.rpm
ftp://updates.redhat.com/7.3/en/os/i386/fetchmailconf-5.9.0-21.7.3.i38 6.rpm

RedHat fetchmailconf-5.9.0-21.7.3.ia64.rpm
ftp://updates.redhat.com/7.2/en/os/ia64/fetchmailconf-5.9.0-21.7.3.ia6 4.rpm

SuSE fetchmail-5.9.0-205.ppc.rpm
ftp://ftp.suse.com/pub/suse/ppc/update/7.3/n1/fetchmail-5.9.0-205.ppc. rpm

SuSE fetchmail-5.9.0-279.i386.patch.rpm
ftp://ftp.suse.com/pub/suse/i386/update/8.0/n1/fetchmail-5.9.0-279.i38 6.patch.rpm

SuSE fetchmail-5.9.0-279.i386.rpm
ftp://ftp.suse.com/pub/suse/i386/update/8.0/n1/fetchmail-5.9.0-279.i38 6.rpm

SuSE fetchmail-5.9.0-280.i386.rpm
ftp://ftp.suse.com/pub/suse/i386/update/7.3/n1/fetchmail-5.9.0-280.i38 6.rpm

SuSE fetchmail-5.9.0-66.sparc.rpm
ftp://ftp.suse.com/pub/suse/sparc/update/7.3/n1/fetchmail-5.9.0-66.spa rc.rpm

Eric Raymond Fetchmail 5.9.1

Eric Raymond fetchmail-6.2.0.tar.gz
http://www.tuxedo.org/~esr/fetchmail/fetchmail-6.2.0.tar.gz

Eric Raymond Fetchmail 5.9.10

Eric Raymond fetchmail-6.2.0.tar.gz
http://www.tuxedo.org/~esr/fetchmail/fetchmail-6.2.0.tar.gz

Eric Raymond Fetchmail 5.9.11

Debian fetchmail-common_5.9.11-6.2_all.deb
Architecture independent package.
http://security.debian.org/pool/updates/main/f/fetchmail/fetchmail-com mon_5.9.11-6.2_all.deb

Debian fetchmail-ssl_5.9.11-6.2_alpha.deb
http://security.debian.org/pool/updates/main/f/fetchmail-ssl/fetchmail -ssl_5.9.11-6.2_alpha.deb

Debian fetchmail-ssl_5.9.11-6.2_arm.deb
http://security.debian.org/pool/updates/main/f/fetchmail-ssl/fetchmail -ssl_5.9.11-6.2_arm.deb

Debian fetchmail-ssl_5.9.11-6.2_hppa.deb
http://security.debian.org/pool/updates/main/f/fetchmail-ssl/fetchmail -ssl_5.9.11-6.2_hppa.deb

Debian fetchmail-ssl_5.9.11-6.2_i386.deb
http://security.debian.org/pool/updates/main/f/fetchmail-ssl/fetchmail -ssl_5.9.11-6.2_i386.deb

Debian fetchmail-ssl_5.9.11-6.2_ia64.deb
http://security.debian.org/pool/updates/main/f/fetchmail-ssl/fetchmail -ssl_5.9.11-6.2_ia64.deb

Debian fetchmail-ssl_5.9.11-6.2_m68k.deb
http://security.debian.org/pool/updates/main/f/fetchmail-ssl/fetchmail -ssl_5.9.11-6.2_m68k.deb

Debian fetchmail-ssl_5.9.11-6.2_mips.deb
http://security.debian.org/pool/updates/main/f/fetchmail-ssl/fetchmail -ssl_5.9.11-6.2_mips.deb

Debian fetchmail-ssl_5.9.11-6.2_mipsel.deb
http://security.debian.org/pool/updates/main/f/fetchmail-ssl/fetchmail -ssl_5.9.11-6.2_mipsel.deb

Debian fetchmail-ssl_5.9.11-6.2_powerpc.deb
http://security.debian.org/pool/updates/main/f/fetchmail-ssl/fetchmail -ssl_5.9.11-6.2_powerpc.deb

Debian fetchmail-ssl_5.9.11-6.2_s390.deb
http://security.debian.org/pool/updates/main/f/fetchmail-ssl/fetchmail -ssl_5.9.11-6.2_s390.deb

Debian fetchmail-ssl_5.9.11-6.2_sparc.deb
http://security.debian.org/pool/updates/main/f/fetchmail-ssl/fetchmail -ssl_5.9.11-6.2_sparc.deb

Debian fetchmail_5.9.11-6.2_alpha.deb
http://security.debian.org/pool/updates/main/f/fetchmail/fetchmail_5.9 .11-6.2_alpha.deb

Debian fetchmail_5.9.11-6.2_arm.deb
http://security.debian.org/pool/updates/main/f/fetchmail/fetchmail_5.9 .11-6.2_arm.deb

Debian fetchmail_5.9.11-6.2_hppa.deb
http://security.debian.org/pool/updates/main/f/fetchmail/fetchmail_5.9 .11-6.2_hppa.deb

Debian fetchmail_5.9.11-6.2_i386.deb
http://security.debian.org/pool/updates/main/f/fetchmail/fetchmail_5.9 .11-6.2_i386.deb

Debian fetchmail_5.9.11-6.2_ia64.deb
http://security.debian.org/pool/updates/main/f/fetchmail/fetchmail_5.9 .11-6.2_ia64.deb

Debian fetchmail_5.9.11-6.2_m68k.deb
http://security.debian.org/pool/updates/main/f/fetchmail/fetchmail_5.9 .11-6.2_m68k.deb

Debian fetchmail_5.9.11-6.2_mips.deb
http://security.debian.org/pool/updates/main/f/fetchmail/fetchmail_5.9 .11-6.2_mips.deb

Debian fetchmail_5.9.11-6.2_mipsel.deb
http://security.debian.org/pool/updates/main/f/fetchmail/fetchmail_5.9 .11-6.2_mipsel.deb

Debian fetchmail_5.9.11-6.2_powerpc.deb
http://security.debian.org/pool/updates/main/f/fetchmail/fetchmail_5.9 .11-6.2_powerpc.deb

Debian fetchmail_5.9.11-6.2_s390.deb
http://security.debian.org/pool/updates/main/f/fetchmail/fetchmail_5.9 .11-6.2_s390.deb

Debian fetchmail_5.9.11-6.2_sparc.deb
http://security.debian.org/pool/updates/main/f/fetchmail/fetchmail_5.9 .11-6.2_sparc.deb

Debian fetchmailconf_5.9.11-6.2_all.deb
Architecture independent package.
http://security.debian.org/pool/updates/main/f/fetchmail/fetchmailconf _5.9.11-6.2_all.deb

Eric Raymond fetchmail-6.2.0.tar.gz
http://www.tuxedo.org/~esr/fetchmail/fetchmail-6.2.0.tar.gz

Eric Raymond Fetchmail 5.9.12

Conectiva fetchmail-5.9.12-1U60_4cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/6.0/RPMS/fetchmail-5.9.12-1U60_4cl .i386.rpm

Conectiva fetchmail-5.9.12-1U70_4cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/7.0/RPMS/fetchmail-5.9.12-1U70_4cl .i386.rpm

Conectiva fetchmail-5.9.12-1U80_3cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/fetchmail-5.9.12-1U80_3cl.i 386.rpm

Conectiva fetchmail-doc-5.9.12-1U60_4cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/6.0/RPMS/fetchmail-doc-5.9.12-1U60 _4cl.i386.rpm

Conectiva fetchmail-doc-5.9.12-1U70_4cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/7.0/RPMS/fetchmail-doc-5.9.12-1U70 _4cl.i386.rpm

Conectiva fetchmail-doc-5.9.12-1U80_3cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/fetchmail-doc-5.9.12-1U80_3 cl.i386.rpm

Conectiva fetchmailconf-5.9.12-1U60_4cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/6.0/RPMS/fetchmailconf-5.9.12-1U60 _4cl.i386.rpm

Conectiva fetchmailconf-5.9.12-1U70_4cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/7.0/RPMS/fetchmailconf-5.9.12-1U70 _4cl.i386.rpm

Conectiva fetchmailconf-5.9.12-1U80_3cl.i386.rpm
ftp://atualizacoes.conectiva.com.br/8/RPMS/fetchmailconf-5.9.12-1U80_3 cl.i386.rpm

Eric Raymond fetchmail-6.2.0.tar.gz
http://www.tuxedo.org/~esr/fetchmail/fetchmail-6.2.0.tar.gz

Eric Raymond Fetchmail 5.9.13

Eric Raymond fetchmail-6.2.0.tar.gz
http://www.tuxedo.org/~esr/fetchmail/fetchmail-6.2.0.tar.gz

SuSE fetchmail-5.9.13-54.i586.patch.rpm
ftp://ftp.suse.com/pub/suse/i386/update/8.1/rpm/i586/fetchmail-5.9.13- 54.i586.patch.rpm

SuSE fetchmail-5.9.13-54.i586.rpm
ftp://ftp.suse.com/pub/suse/i386/update/8.1/rpm/i586/fetchmail-5.9.13- 54.i586.rpm

Eric Raymond Fetchmail 5.9.14

Eric Raymond fetchmail-6.2.0.tar.gz
http://www.tuxedo.org/~esr/fetchmail/fetchmail-6.2.0.tar.gz

Eric Raymond Fetchmail 5.9.2

Eric Raymond fetchmail-6.2.0.tar.gz
http://www.tuxedo.org/~esr/fetchmail/fetchmail-6.2.0.tar.gz

Eric Raymond Fetchmail 5.9.3

Eric Raymond fetchmail-6.2.0.tar.gz
http://www.tuxedo.org/~esr/fetchmail/fetchmail-6.2.0.tar.gz

Eric Raymond Fetchmail 5.9.4

Eric Raymond fetchmail-6.2.0.tar.gz
http://www.tuxedo.org/~esr/fetchmail/fetchmail-6.2.0.tar.gz

Eric Raymond Fetchmail 5.9.5

Eric Raymond fetchmail-6.2.0.tar.gz
http://www.tuxedo.org/~esr/fetchmail/fetchmail-6.2.0.tar.gz

Eric Raymond Fetchmail 5.9.6

Eric Raymond fetchmail-6.2.0.tar.gz
http://www.tuxedo.org/~esr/fetchmail/fetchmail-6.2.0.tar.gz

Eric Raymond Fetchmail 5.9.7

Eric Raymond fetchmail-6.2.0.tar.gz
http://www.tuxedo.org/~esr/fetchmail/fetchmail-6.2.0.tar.gz

Eric Raymond Fetchmail 5.9.8

Eric Raymond fetchmail-6.2.0.tar.gz
http://www.tuxedo.org/~esr/fetchmail/fetchmail-6.2.0.tar.gz

Eric Raymond Fetchmail 5.9.9

Eric Raymond fetchmail-6.2.0.tar.gz
http://www.tuxedo.org/~esr/fetchmail/fetchmail-6.2.0.tar.gz

Eric Raymond Fetchmail 6.0 .0

Eric Raymond fetchmail-6.2.0.tar.gz
http://www.tuxedo.org/~esr/fetchmail/fetchmail-6.2.0.tar.gz

Eric Raymond Fetchmail 6.1 .0

EnGarde Secure Linux fetchmail-ssl-6.1.0-1.0.6.i386.rpm
ftp://ftp.engardelinux.org/pub/engarde/stable/updates/

EnGarde Secure Linux fetchmail-ssl-6.1.0-1.0.6.i686.rpm
ftp://ftp.engardelinux.org/pub/engarde/stable/updates/

Eric Raymond fetchmail-6.2.0.tar.gz
http://www.tuxedo.org/~esr/fetchmail/fetchmail-6.2.0.tar.gz

Mandrake fetchmail-6.1.0-1.1mdk.i586.rpm
Mandrake Firewall 7.2
http://www.mandrakesecure.net/en/ftp.php

Mandrake fetchmail-6.1.0-1.1mdk.i586.rpm
Mandrake Linux 7.2
http://www.mandrakesecure.net/en/ftp.php

Mandrake fetchmail-6.1.0-1.1mdk.i586.rpm
Mandrake Linux 8.0
http://www.mandrakesecure.net/en/ftp.php

Mandrake fetchmail-6.1.0-1.1mdk.i586.rpm
Mandrake Linux 8.1
http://www.mandrakesecure.net/en/ftp.php

Mandrake fetchmail-6.1.0-1.1mdk.i586.rpm
Mandrake Linux 8.2
http://www.mandrakesecure.net/en/ftp.php

Mandrake fetchmail-6.1.0-1.1mdk.i586.rpm
Mandrake Linux 9.0
http://www.mandrakesecure.net/en/ftp.php

Mandrake fetchmail-6.1.0-1.1mdk.ia64.rpm
Mandrake Linux 8.1/IA64
http://www.mandrakesecure.net/en/ftp.php

Mandrake fetchmail-6.1.0-1.1mdk.ppc.rpm
Mandrake Linux 8.0/PPC
http://www.mandrakesecure.net/en/ftp.php

Mandrake fetchmail-6.1.0-1.1mdk.ppc.rpm
Mandrake Linux 8.2/PPC
http://www.mandrakesecure.net/en/ftp.php

Mandrake fetchmail-daemon-6.1.0-1.1mdk.i586.rpm
Mandrake Firewall 7.2
http://www.mandrakesecure.net/en/ftp.php

Mandrake fetchmail-daemon-6.1.0-1.1mdk.i586.rpm
Mandrake Linux 7.2
http://www.mandrakesecure.net/en/ftp.php

Mandrake fetchmail-daemon-6.1.0-1.1mdk.i586.rpm
Mandrake Linux 8.0
http://www.mandrakesecure.net/en/ftp.php

Mandrake fetchmail-daemon-6.1.0-1.1mdk.i586.rpm
Mandrake Linux 8.1
http://www.mandrakesecure.net/en/ftp.php

Mandrake fetchmail-daemon-6.1.0-1.1mdk.i586.rpm
Mandrake Linux 8.2
http://www.mandrakesecure.net/en/ftp.php

Mandrake fetchmail-daemon-6.1.0-1.1mdk.i586.rpm
Mandrake Linux 9.0
http://www.mandrakesecure.net/en/ftp.php

Mandrake fetchmail-daemon-6.1.0-1.1mdk.ia64.rpm
Mandrake Linux 8.1/IA64
http://www.mandrakesecure.net/en/ftp.php

Mandrake fetchmail-daemon-6.1.0-1.1mdk.ppc.rpm
Mandrake Linux 8.0/PPC
http://www.mandrakesecure.net/en/ftp.php

Mandrake fetchmail-daemon-6.1.0-1.1mdk.ppc.rpm
Mandrake Linux 8.2/PPC
http://www.mandrakesecure.net/en/ftp.php

Mandrake fetchmailconf-6.1.0-1.1mdk.i586.rpm
Mandrake Firewall 7.2
http://www.mandrakesecure.net/en/ftp.php

Mandrake fetchmailconf-6.1.0-1.1mdk.i586.rpm
Mandrake Linux 7.2
http://www.mandrakesecure.net/en/ftp.php

Mandrake fetchmailconf-6.1.0-1.1mdk.i586.rpm
Mandrake Linux 8.0
http://www.mandrakesecure.net/en/ftp.php

Mandrake fetchmailconf-6.1.0-1.1mdk.i586.rpm
Mandrake Linux 8.1
http://www.mandrakesecure.net/en/ftp.php

Mandrake fetchmailconf-6.1.0-1.1mdk.i586.rpm
Mandrake Linux 8.2
http://www.mandrakesecure.net/en/ftp.php

Mandrake fetchmailconf-6.1.0-1.1mdk.i586.rpm
Mandrake Linux 9.0
http://www.mandrakesecure.net/en/ftp.php

Mandrake fetchmailconf-6.1.0-1.1mdk.ia64.rpm
Mandrake Linux 8.1/IA64
http://www.mandrakesecure.net/en/ftp.php

Mandrake fetchmailconf-6.1.0-1.1mdk.ppc.rpm
Mandrake Linux 8.0/PPC
http://www.mandrakesecure.net/en/ftp.php

Mandrake fetchmailconf-6.1.0-1.1mdk.ppc.rpm
Mandrake Linux 8.2/PPC
http://www.mandrakesecure.net/en/ftp.php

Eric Raymond Fetchmail 6.1.3

Eric Raymond fetchmail-6.2.0.tar.gz
http://www.tuxedo.org/~esr/fetchmail/fetchmail-6.2.0.tar.gz