Executive Summary

Informations
Name CVE-2008-2711 First vendor Publication 2008-06-16
Vendor Cve Last vendor Modification 2021-08-09

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:M/Au:N/C:N/I:N/A:P)
Cvss Base Score 4.3 Attack Range Network
Cvss Impact Score 2.9 Attack Complexity Medium
Cvss Expoit Score 8.6 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

fetchmail 6.3.8 and earlier, when running in -v -v (aka verbose) mode, allows remote attackers to cause a denial of service (crash and persistent mail failure) via a malformed mail message with long headers, which triggers an erroneous dereference when using vsnprintf to format log messages.

Original Source

Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2711

CWE : Common Weakness Enumeration

% Id Name
100 % CWE-20 Improper Input Validation

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:10950
 
Oval ID: oval:org.mitre.oval:def:10950
Title: fetchmail 6.3.8 and earlier, when running in -v -v (aka verbose) mode, allows remote attackers to cause a denial of service (crash and persistent mail failure) via a malformed mail message with long headers, which triggers an erroneous dereference when using vsnprintf to format log messages.
Description: fetchmail 6.3.8 and earlier, when running in -v -v (aka verbose) mode, allows remote attackers to cause a denial of service (crash and persistent mail failure) via a malformed mail message with long headers, which triggers an erroneous dereference when using vsnprintf to format log messages.
Family: unix Class: vulnerability
Reference(s): CVE-2008-2711
Version: 5
Platform(s): Red Hat Enterprise Linux 3
CentOS Linux 3
Red Hat Enterprise Linux 4
CentOS Linux 4
Oracle Linux 4
Red Hat Enterprise Linux 5
CentOS Linux 5
Oracle Linux 5
Product(s):
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 116

OpenVAS Exploits

Date Description
2011-08-09 Name : CentOS Update for fetchmail CESA-2009:1427 centos3 i386
File : nvt/gb_CESA-2009_1427_fetchmail_centos3_i386.nasl
2011-08-09 Name : CentOS Update for fetchmail CESA-2009:1427 centos4 i386
File : nvt/gb_CESA-2009_1427_fetchmail_centos4_i386.nasl
2011-08-09 Name : CentOS Update for fetchmail CESA-2009:1427 centos5 i386
File : nvt/gb_CESA-2009_1427_fetchmail_centos5_i386.nasl
2010-05-12 Name : Mac OS X Security Update 2009-001
File : nvt/macosx_secupd_2009-001.nasl
2009-11-17 Name : Mac OS X Version
File : nvt/macosx_version.nasl
2009-09-15 Name : CentOS Security Advisory CESA-2009:1427 (fetchmail)
File : nvt/ovcesa2009_1427.nasl
2009-09-09 Name : RedHat Security Advisory RHSA-2009:1427
File : nvt/RHSA_2009_1427.nasl
2009-04-09 Name : Mandriva Update for fetchmail MDVSA-2008:117 (fetchmail)
File : nvt/gb_mandriva_MDVSA_2008_117.nasl
2009-02-17 Name : Fedora Update for fetchmail FEDORA-2008-5789
File : nvt/gb_fedora_2008_5789_fetchmail_fc9.nasl
2009-02-17 Name : Fedora Update for fetchmail FEDORA-2008-5800
File : nvt/gb_fedora_2008_5800_fetchmail_fc8.nasl
2008-09-04 Name : FreeBSD Ports: fetchmail
File : nvt/freebsd_fetchmail10.nasl
2008-09-04 Name : FreeBSD Ports: fetchmail
File : nvt/freebsd_fetchmail11.nasl
0000-00-00 Name : Slackware Advisory SSA:2008-210-01 fetchmail
File : nvt/esoft_slk_ssa_2008_210_01.nasl

Open Source Vulnerability Database (OSVDB)

Id Description
46304 Fetchmail Large Header Verbose Printing DoS

Nessus® Vulnerability Scanner

Date Description
2013-07-12 Name : The remote Oracle Linux host is missing a security update.
File : oraclelinux_ELSA-2009-1427.nasl - Type : ACT_GATHER_INFO
2012-08-01 Name : The remote Scientific Linux host is missing a security update.
File : sl_20090908_fetchmail_on_SL3_x.nasl - Type : ACT_GATHER_INFO
2009-09-09 Name : The remote CentOS host is missing a security update.
File : centos_RHSA-2009-1427.nasl - Type : ACT_GATHER_INFO
2009-09-09 Name : The remote Red Hat host is missing a security update.
File : redhat-RHSA-2009-1427.nasl - Type : ACT_GATHER_INFO
2009-04-23 Name : The remote Mandriva Linux host is missing one or more security updates.
File : mandriva_MDVSA-2008-117.nasl - Type : ACT_GATHER_INFO
2009-02-13 Name : The remote host is missing a Mac OS X update that fixes various security issues.
File : macosx_SecUpd2009-001.nasl - Type : ACT_GATHER_INFO
2008-07-29 Name : The remote Slackware host is missing a security update.
File : Slackware_SSA_2008-210-01.nasl - Type : ACT_GATHER_INFO
2008-07-02 Name : The remote Fedora host is missing a security update.
File : fedora_2008-5789.nasl - Type : ACT_GATHER_INFO
2008-07-02 Name : The remote Fedora host is missing a security update.
File : fedora_2008-5800.nasl - Type : ACT_GATHER_INFO
2008-07-02 Name : The remote FreeBSD host is missing a security-related update.
File : freebsd_pkg_1e8e63c0478a11dda88d000ea69a5213.nasl - Type : ACT_GATHER_INFO
2008-06-24 Name : The remote FreeBSD host is missing a security-related update.
File : freebsd_pkg_168190df3e9a11dd87bc000ea69a5213.nasl - Type : ACT_GATHER_INFO

Sources (Detail)

Source Url
APPLE http://lists.apple.com/archives/security-announce/2009/Feb/msg00000.html
BID http://www.securityfocus.com/bid/29705
BUGTRAQ http://www.securityfocus.com/archive/1/493391/100/0/threaded
http://www.securityfocus.com/archive/1/494865/100/0/threaded
CONFIRM http://support.apple.com/kb/HT3438
http://wiki.rpath.com/wiki/Advisories:rPSA-2008-0235
http://www.fetchmail.info/fetchmail-SA-2008-01.txt
https://issues.rpath.com/browse/RPL-2623
FEDORA https://www.redhat.com/archives/fedora-package-announce/2008-June/msg01091.html
https://www.redhat.com/archives/fedora-package-announce/2008-June/msg01095.html
MANDRIVA http://www.mandriva.com/security/advisories?name=MDVSA-2008:117
MISC https://bugzilla.novell.com/show_bug.cgi?id=354291
MLIST http://www.openwall.com/lists/oss-security/2008/06/13/1
http://www.openwall.com/lists/oss-security/2021/08/09/1
OVAL https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.ova...
SECTRACK http://www.securitytracker.com/id?1020298
SECUNIA http://secunia.com/advisories/30742
http://secunia.com/advisories/30895
http://secunia.com/advisories/31262
http://secunia.com/advisories/31287
http://secunia.com/advisories/33937
SLACKWARE http://slackware.com/security/viewer.php?l=slackware-security&y=2008&...
VUPEN http://www.vupen.com/english/advisories/2008/1860/references
http://www.vupen.com/english/advisories/2009/0422
XF https://exchange.xforce.ibmcloud.com/vulnerabilities/43121

Alert History

If you want to see full details history, please login or register.
0
1
2
3
4
5
6
7
8
9
10
11
12
Date Informations
2021-08-24 01:05:14
  • Multiple Updates
2021-08-10 00:23:08
  • Multiple Updates
2021-05-05 01:04:48
  • Multiple Updates
2021-05-04 12:07:37
  • Multiple Updates
2021-04-22 01:08:00
  • Multiple Updates
2020-05-23 01:39:35
  • Multiple Updates
2020-05-23 00:21:49
  • Multiple Updates
2018-10-12 00:20:22
  • Multiple Updates
2017-09-29 09:23:35
  • Multiple Updates
2017-08-08 09:24:09
  • Multiple Updates
2016-04-26 17:32:11
  • Multiple Updates
2014-02-17 10:45:22
  • Multiple Updates
2013-05-11 00:19:18
  • Multiple Updates