USN-816-1: fetchmail vulnerability

Releases

• Ubuntu 9.04
• Ubuntu 8.10
• Ubuntu 8.04
• Ubuntu 6.06

Packages

• fetchmail -

Details

Matthias Andree discovered that fetchmail did not properly handle
certificates with NULL characters in the certificate name. A remote
attacker could exploit this to perform a machine-in-the-middle attack to
view sensitive information or alter encrypted communications.

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 9.04

• fetchmail - 6.3.9~rc2-4ubuntu1.1

Ubuntu 8.10

• fetchmail - 6.3.8-11ubuntu3.1

Ubuntu 8.04

• fetchmail - 6.3.8-10ubuntu1.1

Ubuntu 6.06

• fetchmail - 6.3.2-2ubuntu2.3

In general, a standard system upgrade is sufficient to effect the
necessary changes.

References

• CVE-2009-2666