Add fetchmail-SA-2007-02.txt and promote Earl Chew's bug fix to security.

svn path=/branches/BRANCH_6-3/; revision=5120

1 files changed, 74 insertions, 0 deletions

diff --git a/fetchmail-SA-2007-02.txt b/fetchmail-SA-2007-02.txt
new file mode 100644
index 00000000..2ab3363f
--- /dev/null
+++ b/fetchmail-SA-2007-02.txt
@@ -0,0 +1,74 @@
+fetchmail-SA-2007-02: Crash when warning message is rejected
+
+Topics:		Crash when fetchmail-generated warning message is rejected
+
+Author:		Matthias Andree
+Version:	1.0
+Announced:	2007-07-29
+Type:		NULL pointer dereference trigged by outside circumstances
+Impact:		denial of service possible
+Danger:		low
+Credits:	Earl Chew
+CVE Name:	XXX
+URL:		http://fetchmail.berlios.de/fetchmail-SA-2007-01.txt
+Project URL:	http://fetchmail.berlios.de/
+
+Affects:	fetchmail release < 6.3.9
+
+Not affected:	fetchmail release 6.3.9
+
+Corrected:	2007-07-29 fetchmail SVN (rev 5119)
+
+
+0. Release history
+==================
+
+2007-07-29 1.0	first release
+
+
+1. Background
+=============
+
+fetchmail is a software package to retrieve mail from remote POP2, POP3,
+IMAP, ETRN or ODMR servers and forward it to local SMTP, LMTP servers or
+message delivery agents.
+
+fetchmail ships with a graphical, Python/Tkinter based configuration
+utility named "fetchmailconf" to help the user create configuration (run
+control) files for fetchmail.
+
+
+2. Problem description and Impact
+=================================
+
+fetchmail will generated warning messages to the local postmaster or user in
+certain circumstances, for instance when authentication fails.
+
+If this warning message is refused by the SMTP listener that fetchmail is
+talking to, fetchmail attempts to dereference a NULL pointer when trying to find
+out if it should allow a bounce message to be sent.
+
+
+3. Solution
+===========
+
+Install fetchmail 6.3.9 or newer.  The fetchmail source code is available from
+<http://developer.berlios.de/project/showfiles.php?group_id=1824>.
+
+
+A. Copyright, License and Warranty
+==================================
+
+(C) Copyright 2007 by Matthias Andree, <matthias.andree@gmx.de>.
+Some rights reserved.
+
+This work is licensed under the Creative Commons
+Attribution-NonCommercial-NoDerivs German License. To view a copy of
+this license, visit http://creativecommons.org/licenses/by-nc-nd/2.0/de/
+or send a letter to Creative Commons; 559 Nathan Abbott Way;
+Stanford, California 94305; USA.
+
+THIS WORK IS PROVIDED FREE OF CHARGE AND WITHOUT ANY WARRANTIES.
+Use the information herein at your own risk.
+
+END OF fetchmail-SA-2007-02.txt