Joined: 12 May 2004
|Posted: Sun Nov 06, 2005 6:39 pm Post subject: [ GLSA 200511-06 ] fetchmail: Password exposure in fetchmail
|Gentoo Linux Security Advisory
Title: fetchmail: Password exposure in fetchmailconf (GLSA 200511-06)
Date: November 06, 2005
fetchmailconf fails to properly handle file permissions, temporarily exposing sensitive information to other local users.
fetchmail is a utility that retrieves and forwards mail from remote systems using IMAP, POP, and other protocols. It ships with fetchmailconf, a graphical utility used to create configuration files.
Vulnerable: < 188.8.131.52-r1
Unaffected: >= 184.108.40.206-r1
Architectures: All supported architectures
Thomas Wolff discovered that fetchmailconf opens the configuration file with default permissions, writes the configuration to it, and only then restricts read permissions to the owner.
A local attacker could exploit the race condition to retrieve sensitive information like IMAP/POP passwords.
Run "umask 077" to temporarily strengthen default permissions, then run "fetchmailconf" from the same shell.
All fetchmail users should upgrade to the latest version:
|# emerge --sync
# emerge --ask --oneshot --verbose ">=net-mail/fetchmail-220.127.116.11-r1"
Fetchmail Security Advisory
Last edited by GLSA on Sun May 07, 2006 4:59 pm; edited 1 time in total