"A flaw was found in the way fetchmail processed certain APOP authentication requests. By sending certain responses when fetchmail attempted to authenticate against an APOP server, a remote attacker could potentially acquire certain portions of a user's authentication credentials. (CVE-2007-1558) http://fetchmail.berlios.de/fetchmail-SA-2007-01.txt https://developer.berlios.de/project/shownotes.php?group_id=1824&release_id=12610 http://www.securityfocus.com/archive/1/464477/30/0/threaded
Also mutt, See http://dev.mutt.org/trac/ticket/2846
Created attachment 347172 [details] Local copy of Gaëtan Leurent's paper Downloaded from: http://www.eleves.ens.fr/home/leurent/files/APOP_FSE07.pdf
This issue was addressed in multiple mail clients, for detailed list see: https://rhn.redhat.com/errata/CVE-2007-1558.html fetchmail: https://rhn.redhat.com/errata/RHSA-2007-0385.html mutt: https://rhn.redhat.com/errata/RHSA-2007-0386.html evolution / evolution-data-server: https://rhn.redhat.com/errata/RHSA-2007-0344.html https://rhn.redhat.com/errata/RHSA-2007-0353.html thunderbird: https://rhn.redhat.com/errata/RHSA-2007-0401.html seamonkey: https://rhn.redhat.com/errata/RHSA-2007-0402.html
This issue was also addressed in ruby's pop module in ruby versions 1.8.7-p160 and 1.8.6-p368: http://www.ruby-lang.org/en/news/2009/04/18/ruby-1-8-7-p160-and-1-8-6-p368-released/ Upstream ruby patch: http://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=rev&revision=19776
This issue has been addressed in ruby packages in following products: Red Hat Enterprise Linux 4 Red Hat Enterprise Linux 5 Via RHSA-2009:1140 https://rhn.redhat.com/errata/RHSA-2009-1140.html