Support ssl3+ tls1.1, tls1.2 in --sslproto. Report TLS1.1/1.2 if unsupported by OpenSSL.

[~andy/fetchmail] / fetchmail-SA-2007-01.txt

diff --git a/fetchmail-SA-2007-01.txt b/fetchmail-SA-2007-01.txt
index 19bb91c9475316be7b5dbf15a028cf58554707b2..2b3c1785e62c151aa2079a63fe4bdd4fca69f551 100644 (file)
--- a/fetchmail-SA-2007-01.txt
+++ b/fetchmail-SA-2007-01.txt
@@ -1,17 +1,20 @@
+-----BEGIN PGP SIGNED MESSAGE-----
+Hash: SHA1
+
 fetchmail-SA-2007-01: APOP considered insecure
 
 Topics:                APOP authentication insecure, fetchmail implementation lax
 
 Author:                Matthias Andree
-Version:       1.0
+Version:       1.1
 Announced:     2007-04-06
 Type:          password theft when under MITM attack
 Impact:                password disclosure possible
 Danger:                low
 Credits:       Gaëtan Leurent
 CVE Name:      CVE-2007-1558
-URL:           http://fetchmail.berlios.de/fetchmail-SA-2007-01.txt
-Project URL:   http://fetchmail.berlios.de/
+URL:           http://fetchmail.sourceforge.net/fetchmail-SA-2007-01.txt
+Project URL:   http://fetchmail.sourceforge.net/
 
 Affects:       fetchmail release < 6.3.8
 
@@ -24,6 +27,7 @@ Corrected:    2007-03-18 fetchmail SVN
 ==================
 
 2007-04-06 1.0 first release
+2008-04-24 1.1 add --ssl to section 3. suggestion A below
 
 
 1. Background
@@ -64,7 +68,7 @@ Either of these is currently considered sufficient.
 
 A. Only use APOP on SSL or TLS secured connections with mandatory and thorough
    certificate validation, such as fetchmail --sslproto tls1 --sslcertck
-   or --sslproto ssl3 --sslcertck), or equivalent in the run control file.
+   or --ssl --sslproto ssl3 --sslcertck), or equivalent in the run control file.
 
 B. Avoid APOP and use stronger authenticators.
 
@@ -72,22 +76,38 @@ C. If you must continue to use APOP without SSL/TLS, then install
    fetchmail 6.3.8 or newer, as it is less susceptible to the attack by
    validating the APOP challenge more strictly to make the attack
    harder. The fetchmail 6.3.8 source code is available from
-   <http://developer.berlios.de/project/showfiles.php?group_id=1824>.
+   <http://sourceforge.net/projects/fetchmail/files/>.
 
 
 A. Copyright, License and Warranty
 ==================================
 
-(C) Copyright 2007 by Matthias Andree, <matthias.andree@gmx.de>.
+(C) Copyright 2007, 2008 by Matthias Andree, <matthias.andree@gmx.de>.
 Some rights reserved.
 
-This work is licensed under the Creative Commons
-Attribution-NonCommercial-NoDerivs German License. To view a copy of
-this license, visit http://creativecommons.org/licenses/by-nc-nd/2.0/de/
-or send a letter to Creative Commons; 559 Nathan Abbott Way;
-Stanford, California 94305; USA.
+This work is licensed under the
+Creative Commons Attribution-NoDerivs 3.0 Germany License (CC BY-ND 3.0).
+
+To view a copy of this license, visit
+http://creativecommons.org/licenses/by-nd/3.0/de/deed.en
+or send a letter to:
+
+Creative Commons
+444 Castro Street
+Suite 900
+MOUNTAIN VIEW, CALIFORNIA 94041
+USA
+
 
 THIS WORK IS PROVIDED FREE OF CHARGE AND WITHOUT ANY WARRANTIES.
 Use the information herein at your own risk.
 
 END OF fetchmail-SA-2007-01.txt
+
+-----BEGIN PGP SIGNATURE-----
+Version: GnuPG v1.4.11 (GNU/Linux)
+
+iEYEARECAAYFAlN9DK0ACgkQvmGDOQUufZXpcQCgxzyViEuWv9/kZ6aE8PvfeEev
+8ZsAoLQCAZbK1MHuP/FLeviuVOeHRxO1
+=FH2Q
+-----END PGP SIGNATURE-----