CVE-2002-1365: Buffer Overflow

Q: What is the severity of CVE-2002-1365?

CVE-2002-1365 is classified as a critical vulnerability due to its ability to allow remote attackers to execute arbitrary code.

Q: How do I fix CVE-2002-1365?

To remediate CVE-2002-1365, users should upgrade to Fetchmail versions later than 6.1.3.

Q: What type of vulnerability is CVE-2002-1365?

CVE-2002-1365 is a heap-based buffer overflow vulnerability affecting Fetchmail.

Q: What versions of Fetchmail are affected by CVE-2002-1365?

CVE-2002-1365 affects Fetchmail versions 6.1.3 and earlier as well as several other specified earlier versions.

Q: Can CVE-2002-1365 be exploited remotely?

Yes, CVE-2002-1365 can be exploited remotely by attackers sending a specially crafted header with a large number of local addresses.

Published Dec 23, 2002

Updated

Heap-based buffer overflow in Fetchmail 6.1.3 and earlier does not account for the "@" character when determining buffer lengths for local addresses, which allows remote attackers to execute arbitrary code via a header with a large number of local addresses.

Affected Software

81 affected components

Fetchmail Fetchmail<=6.1.3

Fetchmail Fetchmail=4.5.1

Fetchmail Fetchmail=4.5.2

Fetchmail Fetchmail=4.5.3

Fetchmail Fetchmail=4.5.4

Fetchmail Fetchmail=4.5.5

Fetchmail Fetchmail=4.5.6

Fetchmail Fetchmail=4.5.7

Fetchmail Fetchmail=4.5.8

Fetchmail Fetchmail=4.6.0

Fetchmail Fetchmail=4.6.1

Fetchmail Fetchmail=4.6.2

Fetchmail Fetchmail=4.6.3

Fetchmail Fetchmail=4.6.4

Fetchmail Fetchmail=4.6.5

Fetchmail Fetchmail=4.6.6

Fetchmail Fetchmail=4.6.7

Fetchmail Fetchmail=4.6.8

Fetchmail Fetchmail=4.6.9

Fetchmail Fetchmail=4.7.0

Fetchmail Fetchmail=4.7.1

Fetchmail Fetchmail=4.7.2

Fetchmail Fetchmail=4.7.3

Fetchmail Fetchmail=4.7.4

Fetchmail Fetchmail=4.7.5

Fetchmail Fetchmail=4.7.6

Fetchmail Fetchmail=4.7.7

Fetchmail Fetchmail=5.0.0

Fetchmail Fetchmail=5.0.1

Fetchmail Fetchmail=5.0.2

Fetchmail Fetchmail=5.0.3

Fetchmail Fetchmail=5.0.4

Fetchmail Fetchmail=5.0.5

Fetchmail Fetchmail=5.0.6

Fetchmail Fetchmail=5.0.7

Fetchmail Fetchmail=5.0.8

Fetchmail Fetchmail=5.1.0

Fetchmail Fetchmail=5.1.4

Fetchmail Fetchmail=5.2.0

Fetchmail Fetchmail=5.2.1

Fetchmail Fetchmail=5.2.3

Fetchmail Fetchmail=5.2.4

Fetchmail Fetchmail=5.2.7

Fetchmail Fetchmail=5.2.8

Fetchmail Fetchmail=5.3.0

Fetchmail Fetchmail=5.3.1

Fetchmail Fetchmail=5.3.3

Fetchmail Fetchmail=5.3.8

Fetchmail Fetchmail=5.4.0

Fetchmail Fetchmail=5.4.3

Fetchmail Fetchmail=5.4.4

Fetchmail Fetchmail=5.4.5

Fetchmail Fetchmail=5.5.0

Fetchmail Fetchmail=5.5.2

Fetchmail Fetchmail=5.5.3

Fetchmail Fetchmail=5.5.5

Fetchmail Fetchmail=5.5.6

Fetchmail Fetchmail=5.6.0

Fetchmail Fetchmail=5.7.0

Fetchmail Fetchmail=5.7.2

Fetchmail Fetchmail=5.7.4

Fetchmail Fetchmail=5.8

Fetchmail Fetchmail=5.8.1

Fetchmail Fetchmail=5.8.2

Fetchmail Fetchmail=5.8.3

Fetchmail Fetchmail=5.8.4

Fetchmail Fetchmail=5.8.5

Fetchmail Fetchmail=5.8.6

Fetchmail Fetchmail=5.8.11

Fetchmail Fetchmail=5.8.13

Fetchmail Fetchmail=5.8.14

Fetchmail Fetchmail=5.8.17

Fetchmail Fetchmail=5.9.0

Fetchmail Fetchmail=5.9.4

Fetchmail Fetchmail=5.9.5

Fetchmail Fetchmail=5.9.8

Fetchmail Fetchmail=5.9.10

Fetchmail Fetchmail=5.9.11

Fetchmail Fetchmail=5.9.13

Fetchmail Fetchmail=6.0.0

Fetchmail Fetchmail=6.1.0

Remediation

Patch Available

http://www.redhat.com/support/errata/RHSA-2002-293.html

Event History

Dec 23, 2002

CVE Published

05:00 AM

Sep 1, 2004

CVE Published

via MITRE·08:00 AM

Data Sourced

via MITRE·08:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2002-1365?

CVE-2002-1365 is classified as a critical vulnerability due to its ability to allow remote attackers to execute arbitrary code.

How do I fix CVE-2002-1365?