Fedora Account System
Red Hat Associate
Red Hat Customer
"A flaw was found in the way fetchmail processed certain APOP authentication requests. By sending certain responses when fetchmail attempted to authenticate against an APOP server, a remote attacker could potentially acquire certain portions of a user's authentication credentials. (CVE-2007-1558) http://fetchmail.berlios.de/fetchmail-SA-2007-01.txt https://developer.berlios.de/project/shownotes.php?group_id=1824&release_id=12610 http://www.securityfocus.com/archive/1/464477/30/0/threaded
Also mutt, See http://dev.mutt.org/trac/ticket/2846
Created attachment 347172 [details] Local copy of Gaëtan Leurent's paper Downloaded from: http://www.eleves.ens.fr/home/leurent/files/APOP_FSE07.pdf
This issue was addressed in multiple mail clients, for detailed list see: https://rhn.redhat.com/errata/CVE-2007-1558.html fetchmail: https://rhn.redhat.com/errata/RHSA-2007-0385.html mutt: https://rhn.redhat.com/errata/RHSA-2007-0386.html evolution / evolution-data-server: https://rhn.redhat.com/errata/RHSA-2007-0344.html https://rhn.redhat.com/errata/RHSA-2007-0353.html thunderbird: https://rhn.redhat.com/errata/RHSA-2007-0401.html seamonkey: https://rhn.redhat.com/errata/RHSA-2007-0402.html
This issue was also addressed in ruby's pop module in ruby versions 1.8.7-p160 and 1.8.6-p368: http://www.ruby-lang.org/en/news/2009/04/18/ruby-1-8-7-p160-and-1-8-6-p368-released/ Upstream ruby patch: http://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=rev&revision=19776
This issue has been addressed in ruby packages in following products: Red Hat Enterprise Linux 4 Red Hat Enterprise Linux 5 Via RHSA-2009:1140 https://rhn.redhat.com/errata/RHSA-2009-1140.html