Technical Description

A weakness has been identified in Mandriva, which could be exploited by remote attackers to gain knowledge of sensitive information. This issue is caused by an error in Fetchmail. For additional information, see : VUPEN/ADV-2007-1467

Affected Products

Mandriva Linux 2007.0
Mandriva Linux 2007.1
Mandriva Corporate 3.0
Mandriva Corporate 4.0

Solution

Upgrade the affected packages :

Mandriva Linux 2007.0:
c2ac4014b50aa7ca037eb513a22ef02f 2007.0/i586/fetchmail-6.3.4-3.2mdv2007.0.i586.rpm
c199ee31b527efd3175d7ed1e7839901 2007.0/i586/fetchmail-daemon-6.3.4-3.2mdv2007.0.i586.rpm
f3b508c9c0da1153129c915ac4f1fc02 2007.0/i586/fetchmailconf-6.3.4-3.2mdv2007.0.i586.rpm
1a9051dcf0dde7cdacd5e9f322cc3b5c 2007.0/SRPMS/fetchmail-6.3.4-3.2mdv2007.0.src.rpm

Mandriva Linux 2007.0/X86_64:
7226a9c8d3ce66fc011b91433bfc8803 2007.0/x86_64/fetchmail-6.3.4-3.2mdv2007.0.x86_64.rpm
4a7d05a3a4148d00d91614b1536c9871 2007.0/x86_64/fetchmail-daemon-6.3.4-3.2mdv2007.0.x86_64.rpm
f9c2b0ae0a4390742d371f05c3fe7ec3 2007.0/x86_64/fetchmailconf-6.3.4-3.2mdv2007.0.x86_64.rpm
1a9051dcf0dde7cdacd5e9f322cc3b5c 2007.0/SRPMS/fetchmail-6.3.4-3.2mdv2007.0.src.rpm

Mandriva Linux 2007.1:
d462eecd17cf6ae0b6d6647d33f2d585 2007.1/i586/fetchmail-6.3.6-1.1mdv2007.1.i586.rpm
9d575e6618f47924b9e8c01f650e1829 2007.1/i586/fetchmail-daemon-6.3.6-1.1mdv2007.1.i586.rpm
40b2e12dabe589d0daef1524f29bfbcf 2007.1/i586/fetchmailconf-6.3.6-1.1mdv2007.1.i586.rpm
4c34025ce19a4527150ffbae18e2f310 2007.1/SRPMS/fetchmail-6.3.6-1.1mdv2007.1.src.rpm

Mandriva Linux 2007.1/X86_64:
14fa8c254251a4aa3b1d0a5925fc18d4 2007.1/x86_64/fetchmail-6.3.6-1.1mdv2007.1.x86_64.rpm
b96d1020981b2f778cdd9c69f20b8421 2007.1/x86_64/fetchmail-daemon-6.3.6-1.1mdv2007.1.x86_64.rpm
a2d2ed808460d970bf2f3eeb7dd69336 2007.1/x86_64/fetchmailconf-6.3.6-1.1mdv2007.1.x86_64.rpm
4c34025ce19a4527150ffbae18e2f310 2007.1/SRPMS/fetchmail-6.3.6-1.1mdv2007.1.src.rpm

Corporate 3.0:
6f317ee0374b4a932e419f16cc217cd3 corporate/3.0/i586/fetchmail-6.2.5-3.5.C30mdk.i586.rpm
76bd1c16d25316642b06cef0a731361c corporate/3.0/i586/fetchmail-daemon-6.2.5-3.5.C30mdk.i586.rpm
b8be2f61aafaba91cecc261fa0f39f3f corporate/3.0/i586/fetchmailconf-6.2.5-3.5.C30mdk.i586.rpm
6ecd14b3000639124b09715267449b10 corporate/3.0/SRPMS/fetchmail-6.2.5-3.5.C30mdk.src.rpm

Corporate 3.0/X86_64:
ab17fb41441c61eddd678b285e4c65ca corporate/3.0/x86_64/fetchmail-6.2.5-3.5.C30mdk.x86_64.rpm
493179e57b94b1167576b4ba81f53e4f corporate/3.0/x86_64/fetchmail-daemon-6.2.5-3.5.C30mdk.x86_64.rpm
1d08906af873ad1023947558027e25c7 corporate/3.0/x86_64/fetchmailconf-6.2.5-3.5.C30mdk.x86_64.rpm
6ecd14b3000639124b09715267449b10 corporate/3.0/SRPMS/fetchmail-6.2.5-3.5.C30mdk.src.rpm

Corporate 4.0:
4dcceb3f61790ea207d25a4bcd5d6b5c corporate/4.0/i586/fetchmail-6.2.5-11.4.20060mlcs4.i586.rpm
cc5d060a877c61ce2bf15e9fa4a51694 corporate/4.0/i586/fetchmail-daemon-6.2.5-11.4.20060mlcs4.i586.rpm
2341bb3e1c08c2c43adcfccebb14b4bc corporate/4.0/i586/fetchmailconf-6.2.5-11.4.20060mlcs4.i586.rpm
3cb2cd26ed758afcda29bd7ee95d8f1b corporate/4.0/SRPMS/fetchmail-6.2.5-11.4.20060mlcs4.src.rpm

Corporate 4.0/X86_64:
dcf89b5f7423dd135b18bcd2bb91e9b4 corporate/4.0/x86_64/fetchmail-6.2.5-11.4.20060mlcs4.x86_64.rpm
61a5262f41f1b92cf9ac8e57389f4097 corporate/4.0/x86_64/fetchmail-daemon-6.2.5-11.4.20060mlcs4.x86_64.rpm
1f22ad5a19a85edc0d0f1e89a4b25e77 corporate/4.0/x86_64/fetchmailconf-6.2.5-11.4.20060mlcs4.x86_64.rpm
3cb2cd26ed758afcda29bd7ee95d8f1b corporate/4.0/SRPMS/fetchmail-6.2.5-11.4.20060mlcs4.src.rpm

References

http://www.vupen.com/english/advisories/2007/1857
http://archives.mandrivalinux.com/security-announce/2007-05/msg00020.php

ChangeLog

2007-05-18 : Initial release

Vulnerability Management

Subscribe to VUPEN VNS and receive real-time alerts when new advisories or patches relevant to your systems and network configurations are available.

Feedback

If you have additional information or corrections for this security advisory please submit them via our contact form.