CVE-2002-1175: Input Validation

Q: What is the severity of CVE-2002-1175?

The severity of CVE-2002-1175 is classified as a denial of service vulnerability.

Q: Is my version of Fetchmail affected by CVE-2002-1175?

Fetchmail versions 6.0.0 and earlier, including various earlier versions, are affected by CVE-2002-1175.

Q: How do I mitigate CVE-2002-1175?

To mitigate CVE-2002-1175, update Fetchmail to version 6.0.1 or later.

Q: What issue does CVE-2002-1175 cause?

CVE-2002-1175 allows remote attackers to cause a denial of service condition by exploiting a malformed DNS packet.

Q: What is the potential impact of CVE-2002-1175 on my system?

The potential impact of CVE-2002-1175 is that it may crash the Fetchmail service due to improper handling of DNS packets.

Published Oct 1, 2002

Updated

The getmxrecord function in Fetchmail 6.0.0 and earlier does not properly check the boundary of a particular malformed DNS packet from a malicious DNS server, which allows remote attackers to cause a denial of service (crash) when Fetchmail attempts to read data beyond the expected boundary.

Affected Software

79 affected components

Fetchmail Fetchmail<=6.0.0

Fetchmail Fetchmail=4.5.1

Fetchmail Fetchmail=4.5.2

Fetchmail Fetchmail=4.5.3

Fetchmail Fetchmail=4.5.4

Fetchmail Fetchmail=4.5.5

Fetchmail Fetchmail=4.5.6

Fetchmail Fetchmail=4.5.7

Fetchmail Fetchmail=4.5.8

Fetchmail Fetchmail=4.6.0

Fetchmail Fetchmail=4.6.1

Fetchmail Fetchmail=4.6.2

Fetchmail Fetchmail=4.6.3

Fetchmail Fetchmail=4.6.4

Fetchmail Fetchmail=4.6.5

Fetchmail Fetchmail=4.6.6

Fetchmail Fetchmail=4.6.7

Fetchmail Fetchmail=4.6.8

Fetchmail Fetchmail=4.6.9

Fetchmail Fetchmail=4.7.0

Fetchmail Fetchmail=4.7.1

Fetchmail Fetchmail=4.7.2

Fetchmail Fetchmail=4.7.3

Fetchmail Fetchmail=4.7.4

Fetchmail Fetchmail=4.7.5

Fetchmail Fetchmail=4.7.6

Fetchmail Fetchmail=4.7.7

Fetchmail Fetchmail=5.0.0

Fetchmail Fetchmail=5.0.1

Fetchmail Fetchmail=5.0.2

Fetchmail Fetchmail=5.0.3

Fetchmail Fetchmail=5.0.4

Fetchmail Fetchmail=5.0.5

Fetchmail Fetchmail=5.0.6

Fetchmail Fetchmail=5.0.7

Fetchmail Fetchmail=5.0.8

Fetchmail Fetchmail=5.1.0

Fetchmail Fetchmail=5.1.4

Fetchmail Fetchmail=5.2.0

Fetchmail Fetchmail=5.2.1

Fetchmail Fetchmail=5.2.3

Fetchmail Fetchmail=5.2.4

Fetchmail Fetchmail=5.2.7

Fetchmail Fetchmail=5.2.8

Fetchmail Fetchmail=5.3.0

Fetchmail Fetchmail=5.3.1

Fetchmail Fetchmail=5.3.3

Fetchmail Fetchmail=5.3.8

Fetchmail Fetchmail=5.4.0

Fetchmail Fetchmail=5.4.3

Fetchmail Fetchmail=5.4.4

Fetchmail Fetchmail=5.4.5

Fetchmail Fetchmail=5.5.0

Fetchmail Fetchmail=5.5.2

Fetchmail Fetchmail=5.5.3

Fetchmail Fetchmail=5.5.5

Fetchmail Fetchmail=5.5.6

Fetchmail Fetchmail=5.6.0

Fetchmail Fetchmail=5.7.0

Fetchmail Fetchmail=5.7.2

Fetchmail Fetchmail=5.7.4

Fetchmail Fetchmail=5.8

Fetchmail Fetchmail=5.8.1

Fetchmail Fetchmail=5.8.2

Fetchmail Fetchmail=5.8.3

Fetchmail Fetchmail=5.8.4

Fetchmail Fetchmail=5.8.5

Fetchmail Fetchmail=5.8.6

Fetchmail Fetchmail=5.8.11

Fetchmail Fetchmail=5.8.13

Fetchmail Fetchmail=5.8.14

Fetchmail Fetchmail=5.8.17

Fetchmail Fetchmail=5.9.0

Fetchmail Fetchmail=5.9.4

Fetchmail Fetchmail=5.9.5

Fetchmail Fetchmail=5.9.8

Fetchmail Fetchmail=5.9.10

Fetchmail Fetchmail=5.9.11

Fetchmail Fetchmail=5.9.13

Remediation

Patch Available

http://www.linux-mandrake.com/en/security/2002/MDKSA-2002-063.php

Event History

Oct 1, 2002

CVE Published

via MITRE·08:00 AM

Data Sourced

via MITRE·08:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2002-1175?

The severity of CVE-2002-1175 is classified as a denial of service vulnerability.

Is my version of Fetchmail affected by CVE-2002-1175?