1 fetchmail-SA-2006-02: TLS enforcement problem/MITM attack/password exposure
3 Topics: fetchmail cannot enforce TLS
5 Author: Matthias Andree
8 Type: secret information disclosure
9 Impact: fetchmail can expose cleartext password over unsecure link
10 fetchmail may not detect man in the middle attacks
12 Credits: Isaac Wilcox (bug report, testing, collaboration on fix)
13 CVE Name: CVE-2006-5867
14 URL: http://fetchmail.berlios.de/fetchmail-SA-2006-02.txt
15 Project URL: http://fetchmail.berlios.de/
17 Affects: fetchmail releases <= 6.3.5
18 fetchmail release candidates 6.3.6-rc1, -rc2, -rc3
20 Not affected: fetchmail release candidate 6.3.6-rc4
21 fetchmail release 6.3.6
23 Corrected: 2006-11-26 fetchmail 6.3.6-rc4
29 2006-11-16 v0.01 internal review draft
30 2006-11-26 v0.02 revise failure cases, workaround, add acknowledgments
36 fetchmail is a software package to retrieve mail from remote POP2, POP3,
37 IMAP, ETRN or ODMR servers and forward it to local SMTP, LMTP servers or
38 message delivery agents.
40 fetchmail ships with a graphical, Python/Tkinter based configuration
41 utility named "fetchmailconf" to help the user create configuration (run
42 control) files for fetchmail.
45 2. Problem description and Impact
46 =================================
48 Fetchmail has no configuration facility to enforce TLS connections. This
49 can cause passwords to be sent over unencrypted channels in some cases:
51 V1. sslcertck/sslfingerprint options should have implied "sslproto tls1"
52 in order to enforce TLS negotiation, but did not.
54 V2. Even with "sslproto tls1" in the config, fetches would go ahead
55 in plain text if STLS/STARTTLS wasn't available (not advertised,
56 or advertised but rejected).
58 V3. POP3 fetches would completely ignore all TLS options whether
59 available or not because it didn't issue CAPA before checking
62 This can cause eavesdroppers to obtain the password, depending on the
63 authentication scheme that is configured or auto-selected, and
64 subsequently impersonate somebody else when logging into the upstream
71 W1. If your upstream offers SSLv3-wrapped service on a dedicated port,
72 use fetchmail --ssl --sslcertck --sslproto ssl3 on the command line,
73 or equivalent in the run control file. This encrypts the whole session.
75 The next workarounds do not encrypt the channel, but get along without
78 W2. If your upstream offers authentication schemes that don't require
79 cleartext credentials, use the --auth option to select a safe one, such
80 as Kerberos, GSSAPI, CRAM-MD5, or perhaps OTP.
82 W3. For POP3, if the upstream server supports APOP, you can use
83 --protocol apop to select APOP authentication.
89 Download and install fetchmail 6.3.6 or a newer stable release from
90 fetchmail's project site at
91 <http://developer.berlios.de/project/showfiles.php?group_id=1824>.
97 Isaac Wilcox has been a great help with testing the fixes and getting
101 A. Copyright, License and Warranty
102 ==================================
104 (C) Copyright 2006 by Matthias Andree, <matthias.andree@gmx.de>.
105 Some rights reserved.
107 This work is licensed under the Creative Commons
108 Attribution-NonCommercial-NoDerivs German License. To view a copy of
109 this license, visit http://creativecommons.org/licenses/by-nc-nd/2.0/de/
110 or send a letter to Creative Commons; 559 Nathan Abbott Way;
111 Stanford, California 94305; USA.
113 THIS WORK IS PROVIDED FREE OF CHARGE AND WITHOUT ANY WARRANTIES.
114 Use the information herein at your own risk.
116 END OF fetchmail-SA-2006-02.txt