CVE-2006-5867

Published: Dec 31, 2006Modified: Apr 23, 2026

7.8

Vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Exploitability: 10.0 / Impact: 6.9

Source: NVD

Description

fetchmail before 6.3.6-rc4 does not properly enforce TLS and may transmit cleartext passwords over unsecured links if certain circumstances occur, which allows remote attackers to obtain sensitive information via man-in-the-middle (MITM) attacks.

Affected (109)

Products: Fetchmail: Fetchmail

Fetchmail

1 product

Fetchmail

Configuration A

109 vulnerable

Vulnerable Software	Affected Versions
Fetchmail Fetchmail	Up to 6.3.6
Fetchmail Fetchmail	Version 4.5.1
Fetchmail Fetchmail	Version 4.5.2
Fetchmail Fetchmail	Version 4.5.3
Fetchmail Fetchmail	Version 4.5.4
Fetchmail Fetchmail	Version 4.5.5
Fetchmail Fetchmail	Version 4.5.6
Fetchmail Fetchmail	Version 4.5.7
Fetchmail Fetchmail	Version 4.5.8
Fetchmail Fetchmail	Version 4.6.0
Fetchmail Fetchmail	Version 4.6.1
Fetchmail Fetchmail	Version 4.6.2
Fetchmail Fetchmail	Version 4.6.3
Fetchmail Fetchmail	Version 4.6.4
Fetchmail Fetchmail	Version 4.6.5
Fetchmail Fetchmail	Version 4.6.6
Fetchmail Fetchmail	Version 4.6.7
Fetchmail Fetchmail	Version 4.6.8
Fetchmail Fetchmail	Version 4.6.9
Fetchmail Fetchmail	Version 4.7.0
Fetchmail Fetchmail	Version 4.7.1
Fetchmail Fetchmail	Version 4.7.2
Fetchmail Fetchmail	Version 4.7.3
Fetchmail Fetchmail	Version 4.7.4
Fetchmail Fetchmail	Version 4.7.5
Fetchmail Fetchmail	Version 4.7.6
Fetchmail Fetchmail	Version 4.7.7
Fetchmail Fetchmail	Version 5.0.0
Fetchmail Fetchmail	Version 5.0.1
Fetchmail Fetchmail	Version 5.0.2
Fetchmail Fetchmail	Version 5.0.3
Fetchmail Fetchmail	Version 5.0.4
Fetchmail Fetchmail	Version 5.0.5
Fetchmail Fetchmail	Version 5.0.6
Fetchmail Fetchmail	Version 5.0.7
Fetchmail Fetchmail	Version 5.0.8
Fetchmail Fetchmail	Version 5.1.0
Fetchmail Fetchmail	Version 5.1.4
Fetchmail Fetchmail	Version 5.2.0
Fetchmail Fetchmail	Version 5.2.1
Fetchmail Fetchmail	Version 5.2.3
Fetchmail Fetchmail	Version 5.2.4
Fetchmail Fetchmail	Version 5.2.7
Fetchmail Fetchmail	Version 5.2.8
Fetchmail Fetchmail	Version 5.3.0
Fetchmail Fetchmail	Version 5.3.1
Fetchmail Fetchmail	Version 5.3.3
Fetchmail Fetchmail	Version 5.3.8
Fetchmail Fetchmail	Version 5.4.0
Fetchmail Fetchmail	Version 5.4.3
Fetchmail Fetchmail	Version 5.4.4
Fetchmail Fetchmail	Version 5.4.5
Fetchmail Fetchmail	Version 5.5.0
Fetchmail Fetchmail	Version 5.5.2
Fetchmail Fetchmail	Version 5.5.3
Fetchmail Fetchmail	Version 5.5.5
Fetchmail Fetchmail	Version 5.5.6
Fetchmail Fetchmail	Version 5.6.0
Fetchmail Fetchmail	Version 5.7.0
Fetchmail Fetchmail	Version 5.7.2
Fetchmail Fetchmail	Version 5.7.4
Fetchmail Fetchmail	Version 5.8.11
Fetchmail Fetchmail	Version 5.8.13
Fetchmail Fetchmail	Version 5.8.14
Fetchmail Fetchmail	Version 5.8.17
Fetchmail Fetchmail	Version 5.8.1
Fetchmail Fetchmail	Version 5.8.2
Fetchmail Fetchmail	Version 5.8.3
Fetchmail Fetchmail	Version 5.8.4
Fetchmail Fetchmail	Version 5.8.5
Fetchmail Fetchmail	Version 5.8.6
Fetchmail Fetchmail	Version 5.8
Fetchmail Fetchmail	Version 5.9.0
Fetchmail Fetchmail	Version 5.9.10
Fetchmail Fetchmail	Version 5.9.11
Fetchmail Fetchmail	Version 5.9.13
Fetchmail Fetchmail	Version 5.9.4
Fetchmail Fetchmail	Version 5.9.5
Fetchmail Fetchmail	Version 5.9.8
Fetchmail Fetchmail	Version 6.0.0
Fetchmail Fetchmail	Version 6.1.0
Fetchmail Fetchmail	Version 6.1.3
Fetchmail Fetchmail	Version 6.2.0
Fetchmail Fetchmail	Version 6.2.1
Fetchmail Fetchmail	Version 6.2.2
Fetchmail Fetchmail	Version 6.2.3
Fetchmail Fetchmail	Version 6.2.4
Fetchmail Fetchmail	Version 6.2.5.1
Fetchmail Fetchmail	Version 6.2.5.2
Fetchmail Fetchmail	Version 6.2.5.4
Fetchmail Fetchmail	Version 6.2.5
Fetchmail Fetchmail	Version 6.2.6 pre4
Fetchmail Fetchmail	Version 6.2.6 pre8
Fetchmail Fetchmail	Version 6.2.6 pre9
Fetchmail Fetchmail	Version 6.2.9 rc10
Fetchmail Fetchmail	Version 6.2.9 rc3
Fetchmail Fetchmail	Version 6.2.9 rc4
Fetchmail Fetchmail	Version 6.2.9 rc5
Fetchmail Fetchmail	Version 6.2.9 rc7
Fetchmail Fetchmail	Version 6.2.9 rc8
Fetchmail Fetchmail	Version 6.2.9 rc9
Fetchmail Fetchmail	Version 6.3.0
Fetchmail Fetchmail	Version 6.3.1
Fetchmail Fetchmail	Version 6.3.2
Fetchmail Fetchmail	Version 6.3.3
Fetchmail Fetchmail	Version 6.3.4
Fetchmail Fetchmail	Version 6.3.5
Fetchmail Fetchmail	Version 6.3.6 rc1
Fetchmail Fetchmail	Version 6.3.6 rc2

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (74)

ftp://patches.sgi.com/support/free/security/advisories/20070201-01-P.asc (unsafe URL)

Source: cve@mitre.org

http://docs.info.apple.com/article.html?artnum=305391

Source: cve@mitre.org

http://fedoranews.org/cms/node/2429

Source: cve@mitre.org

http://fetchmail.berlios.de/fetchmail-SA-2006-02.txt

Source: cve@mitre.org

http://lists.apple.com/archives/Security-announce/2007/Apr/msg00001.html

Source: cve@mitre.org

http://osvdb.org/31580

Source: cve@mitre.org

http://secunia.com/advisories/23631

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/23695

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/23714

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/23781

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/23804

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/23838

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/23923

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/24007

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/24151

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/24174

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/24284

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/24966

Source: cve@mitre.org

Vendor Advisory

http://security.gentoo.org/glsa/glsa-200701-13.xml

Source: cve@mitre.org

http://securitytracker.com/id?1017478

Source: cve@mitre.org

http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.517995

Source: cve@mitre.org

http://www.debian.org/security/2007/dsa-1259

Source: cve@mitre.org

http://www.mandriva.com/security/advisories?name=MDKSA-2007:016

Source: cve@mitre.org

http://www.novell.com/linux/security/advisories/2007_4_sr.html

Source: cve@mitre.org

http://www.openpkg.com/security/advisories/OpenPKG-SA-2007.004.html

Source: cve@mitre.org

http://www.redhat.com/support/errata/RHSA-2007-0018.html

Source: cve@mitre.org

http://www.securityfocus.com/archive/1/456115/100/0/threaded

Source: cve@mitre.org

http://www.securityfocus.com/archive/1/460528/100/0/threaded

Source: cve@mitre.org

http://www.securityfocus.com/bid/21903

Source: cve@mitre.org

Patch

http://www.trustix.org/errata/2007/0007

Source: cve@mitre.org

http://www.ubuntu.com/usn/usn-405-1

Source: cve@mitre.org

http://www.us-cert.gov/cas/techalerts/TA07-109A.html

Source: cve@mitre.org

US Government Resource

http://www.vupen.com/english/advisories/2007/0087

Source: cve@mitre.org

http://www.vupen.com/english/advisories/2007/0088

Source: cve@mitre.org

http://www.vupen.com/english/advisories/2007/1470

Source: cve@mitre.org

https://issues.rpath.com/browse/RPL-919

Source: cve@mitre.org

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10566

Source: cve@mitre.org

ftp://patches.sgi.com/support/free/security/advisories/20070201-01-P.asc (unsafe URL)