On Sat, 2006-03-04 at 19:31 +0100, Matthias Andree wrote:
+> "Peter N. Spotts" <pspotts at alum.mit.edu> writes:
+>
+> > I've been running fetchmail on SuSE 10.0 on my laptop, and until today
+> > (when I installed the latest version of fetchmail) I've been running
+> > 6.2.X.
+>
+> [...]
+>
+> > So although my ISP is Comcast (I noted the Comcast caveats on
+> > the FAQ page), Comcast does not seem to be the problem either.
+>
+> That would be news.
+>
+> fetchmail, beginning with version 6.3.2, recognizes Comcast's broken
+> servers ("Maillennium POP3/PROXY server") and disables the problematic
+> use of the TOP command and uses RETR instead - so updating to 6.3.2
+> should have fixed all known Comcast problems.
+>
+> --
+> Matthias Andree
+
+Matthias,
+
+My apologies for the tardy reply. I'll remove the fetchall command from
+my rc file and see how things work. I should have said earlier that I
+had just updated to 6.3.2 that morning but hadn't tried it yet...I just
+had this urge to write something after several weeks of
+frustration! ;-)
+
+With best regards,
+
+Pete
+--
+
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ Peter N. Spotts | Science Correspondent
+ The Christian Science Monitor
+ One Norway Street, Boston MA 02115
+ Office: 617-450-2449 | Office in home: 508-520-3139
+ Email: pspotts at alum.mit.edu | www.csmonitor.com
+ Amateur-radio call - KC1JB
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+"The knack of flying is to throw yourself at the ground and miss."
+ -- Douglas Adams
+
+
+
+
Hello,
+
+I found a security vulnerability in the APOP authentication. It is
+related to recent collision attacks by Wang and al. against MD5. The
+basic idea is to craft a pair of message-ids that will collide in the
+APOP hash if the password begins in a specified way. So the attacker
+would impersonate a POP server, and send these msg-id; the client will
+return the hash, and the attacker can learn some password characters.
+
+The msg-ids will be generated from a MD5 collision: if you have two
+colliding messages for MD5 "<????@????>x" and "<¿¿¿¿@¿¿¿¿>x", and the
+message are of length two blocks, then you will use "<????@????>" and
+"<¿¿¿¿@¿¿¿¿>" as msg-ids. When the client computes MD5(msg-id||passwd)
+with these two, it will collide if the first password character if 'x',
+no matter what is next (since we are at a block boundary, and the end of
+the password will be the same in the two hashs). Therefore you can
+learn the password characters one by one (actually you can only recover
+three of them, due to the way MD5 collisions are computed).
+
+This attack is really a practical one: it needs about an hour of
+computation and a few hundred authentications from the client, and can
+recover three password characters. I tested it against fetchmail, and
+it does work.
+
+However, using the current techniques available to attack MD5, the
+msg-ids sent by the server can easily be distinguished from genuine ones
+as they will not respect the RFC specification. In particular, they
+will contain non-ASCII characters. Therefore, as a security
+countermeasure, I think fetchmail should reject msg-ids that does not
+conform to the RFC.
+
+The details of the attack and the new results against MD5 needed to
+build it will be presented in the Fast Software Encryption conference on
+March 28. I can send you some more details if needed.
+
+Meanwhile, feel free to alert any one that you believe is concerned.
+I am already sending this mail to the maintainers of Thunderbird,
+Evolution, fetchmail, and mutt. KMail already seems to do enough checks
+on the msg-id to avoid the attack.
+
+Please CC me in any reply.
+
+--
+Gaëtan LEURENT
+
+
+
+
+More information about the fetchmail-devel
+mailing list
+
diff --git a/archived-messages/patch-6.3.2.1-fix-netrc-SIGSEGV.diff b/archived-messages/patch-6.3.2.1-fix-netrc-SIGSEGV.diff
new file mode 100644
index 00000000..590a201d
--- /dev/null
+++ b/archived-messages/patch-6.3.2.1-fix-netrc-SIGSEGV.diff
@@ -0,0 +1,46 @@
+
+
+
+
+Object not found!
+
+
+
+
+
+
Object not found!
+
+
+
+ The requested URL was not found on this server.
+
+
+
+ If you entered the URL manually please check your
+ spelling and try again.
+
+
+
+
+
+If you think this is a server error, please contact
+the webmaster.
+
+
+
+
Error (none)
+
+ download.berlios.de
+
+ Wed May 21 22:24:15 2014
+ Apache
+
+
+
+
diff --git a/configure.ac b/configure.ac
index 5efd8d1a..bdcbb20c 100644
--- a/configure.ac
+++ b/configure.ac
@@ -9,7 +9,7 @@ dnl Process this file with autoconf to produce a configure script.
dnl
dnl XXX - if bumping version here, check fetchmail.man, too!
-AC_INIT([fetchmail],[6.3.26],[fetchmail-users@lists.berlios.de])
+AC_INIT([fetchmail],[6.3.27],[fetchmail-users@lists.sourceforge.net])
AC_CONFIG_SRCDIR([fetchmail.h])
AC_CONFIG_HEADERS([config.h])
AC_CONFIG_LIBOBJ_DIR([.])
diff --git a/contrib/README.mold_remover b/contrib/README.mold_remover
index 09adddc0..bb650bf9 100644
--- a/contrib/README.mold_remover
+++ b/contrib/README.mold_remover
@@ -1,7 +1,7 @@
Mold Remover
Mold Remover is a short python script which integrates with fetchmail
- and allows the user to specify the
+ and allows the user to specify the
number of days that mail should remain on the pop3 server before being
deleted.
diff --git a/dist-tools/makerelease.pl b/dist-tools/makerelease.pl
index f07af094..d7a49cfc 100755
--- a/dist-tools/makerelease.pl
+++ b/dist-tools/makerelease.pl
@@ -6,8 +6,8 @@
#
my $project = "fetchmail";
-my $website = "http://developer.berlios.de/projects/$project";
-my $mailfrom = "<$project-devel\@lists.berlios.de> (Fetchmail Development Team)";
+my $website = "http://sourceforge.net/projects/$project";
+my $mailfrom = "<$project-devel\@lists.sourceforge.net> (Fetchmail Development Team)";
my $distsufx = '.tar.bz2';
my $xzsufx = '.tar.xz';
@@ -195,10 +195,6 @@ print "=== local\n";
system("cp", "autobuild/$project-$version$xzsufx", "autobuild/$project-$version$xzsufx.asc", "$ENV{HOME}/public_html/fetchmail/") and die "Cannot upload to \$HOME/public_html/fetchmail/: $!";
-print "=== berlios\n";
-
-system("lftp -e \"lcd autobuild ; mput $project-$version$distsufx $project-$version$distsufx.asc ; quit\" ftp.berlios.de:/incoming/") and warn "Upload to berlios failed: $!";
-
print "=== sourceforge \n";
system("rsync -acvHP autobuild/$project-$version$xzsufx autobuild/$project-$version$xzsufx.asc autobuild/README m-a\@frs.sourceforge.net:/home/frs/project/fetchmail/branch_6.3/");
unlink 'autobuild/README' or die "cannot unlink autobuild/README: $!";
diff --git a/dist-tools/test/test-request b/dist-tools/test/test-request
index 56c31be7..c25e44e9 100644
--- a/dist-tools/test/test-request
+++ b/dist-tools/test/test-request
@@ -1,8 +1,7 @@
I maintain an open-source POP and IMAP client called fetchmail. It is
widely used in the Linux and open-source community, and is probably
the single most popular remote-mail client in that world. You can
-find out more about this project at
-.
+find out more about this project at .
In order to be able to do thorough regression testing before each release,
I collect test accounts on as many different kinds of POP3, IMAP, and
diff --git a/fetchmail-EN-2010-03.txt b/fetchmail-EN-2010-03.txt
index 9895a582..42e32429 100644
--- a/fetchmail-EN-2010-03.txt
+++ b/fetchmail-EN-2010-03.txt
@@ -6,7 +6,7 @@ fetchmail-EN-2010-03: fetchmail SASL bugs prevent successful authentication
Topics: Authentication incapability in older fetchmail versions
Author: Matthias Andree
-Version: 1.0
+Version: 1.1
Announced: 2010-10-16
Impact: Denial of service
@@ -29,6 +29,7 @@ Corrected: 2010-10-09 Git, required commit:
==================
2010-10-16 1.0 complete
+2014-05-21 1.1 update BerliOS links
1. Background
@@ -78,7 +79,7 @@ and all previous releases.
Install fetchmail release 6.3.18 or newer.
The fetchmail source code is always available from
-.
+.
Since the changes are non-trivial, 6.3.18 contains other unrelated
important fixes (such as applying timeout to the authentication phase,
@@ -87,7 +88,7 @@ have been tested, no separate patch is made available.
For details on what else changed in release 6.3.18, please see the NEWS
file shipping with fetchmail 6.3.18, or its online copy at
-.
+
4. Workaround
@@ -125,7 +126,7 @@ Use the information herein at your own risk.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
-iEYEARECAAYFAk9/YgsACgkQvmGDOQUufZWwQwCgvBxomOVufQuUh96nEq95Mnz4
-5m8AoKkBIERmVh9MzN4aJBKbqRQX+2Hq
-=GwOi
+iEYEARECAAYFAlN9DK0ACgkQvmGDOQUufZWdAQCfYcPWZiMcEl9H2SXKf80eMktw
+Wc8AoNt/rtXWGD/FpPvhlBSr95eO6PF1
+=5MPV
-----END PGP SIGNATURE-----
diff --git a/fetchmail-FAQ.html b/fetchmail-FAQ.html
index 14951a34..429d80ca 100644
--- a/fetchmail-FAQ.html
+++ b/fetchmail-FAQ.html
@@ -42,7 +42,7 @@ case you need the new option.
.
When sending bugs or asking for help, please do not make up
information except your password and please
report the following:
@@ -388,8 +388,8 @@ any suspicion that the bug was triggered by a particular message,
please include a copy of the message that triggered the bug.
There is a fetchmail-users list
-<fetchmail-users@lists.berlios.de>
+<fetchmail-users@lists.sourceforge.net>
for bug reports and people who want to discuss configuration issues of
fetchmail. Please see G3 above for information you need to
report. It's a Mailman list, see http://lists.berlios.de/mailman/listinfo/fetchmail-users
+ href="http://lists.sourceforge.net/mailman/listinfo/fetchmail-users">http://lists.sourceforge.net/mailman/listinfo/fetchmail-users
for info and subscription.
There is a fetchmail-devel list
-<fetchmail-devel@lists.berlios.de> for people who want to discuss
+<fetchmail-devel@lists.sourceforge.net> for people who want to discuss
fixes and improvements in fetchmail and help co-develop it. It's a
Mailman list, which you can sign up for at http://lists.berlios.de/mailman/listinfo/fetchmail-devel.
diff --git a/fetchmail-SA-2005-01.txt b/fetchmail-SA-2005-01.txt
index 754e6dc0..0f634698 100644
--- a/fetchmail-SA-2005-01.txt
+++ b/fetchmail-SA-2005-01.txt
@@ -16,7 +16,7 @@ Danger: high: in sensitive configurations, a full system
(for 6.2.5.1: denial of service for the whole fetchmail
system is possible)
CVE Name: CVE-2005-2335
-URL: http://fetchmail.berlios.de/fetchmail-SA-2005-01.txt
+URL: http://fetchmail.sourceforge.net/fetchmail-SA-2005-01.txt
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=212762
http://www.vuxml.org/freebsd/3497d7be-2fef-45f4-8162-9063751b573a.html
http://www.vuxml.org/freebsd/3f4ac724-fa8b-11d9-afcf-0060084a00e5.html
@@ -103,11 +103,11 @@ No reasonable workaround can be offered at this time.
Upgrade your fetchmail package to version 6.3.0 or newer.
-
+
A. References
-fetchmail home page:
+fetchmail home page:
B. Copyright, License and Warranty
@@ -134,7 +134,7 @@ END OF fetchmail-SA-2005-01.txt
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
-iEYEARECAAYFAk9/Yg4ACgkQvmGDOQUufZVgGgCfer/s64xaU71GiAQ6bpu5Lrei
-ysgAnj2MQhFOxIzzw7V9qyp095NotaOO
-=uLfy
+iEYEARECAAYFAlN9DK0ACgkQvmGDOQUufZWmcQCdGrMPh1DY+Uqi5gmRbL+uUsOd
+BpQAn3pBsk4fCeMY61d2ltjcp+CXj8Bi
+=WTmI
-----END PGP SIGNATURE-----
diff --git a/fetchmail-SA-2005-02.txt b/fetchmail-SA-2005-02.txt
index d46275e2..64e614b9 100644
--- a/fetchmail-SA-2005-02.txt
+++ b/fetchmail-SA-2005-02.txt
@@ -14,7 +14,7 @@ Danger: medium
Credits: Thomas Wolff, Miloslav Trmac for pointing out
that fetchmailconf 1.43.1 was also flawed
CVE Name: CVE-2005-3088
-URL: http://fetchmail.berlios.de/fetchmail-SA-2005-02.txt
+URL: http://fetchmail.sourceforge.net/fetchmail-SA-2005-02.txt
Affects: fetchmail version 6.2.5.2
fetchmail version 6.2.5
@@ -74,12 +74,12 @@ fetchmailconf has finished, you can restore your old umask.
Download and install fetchmail 6.3.0 or a newer stable release from
fetchmail's project site at
-.
+.
A. References
=============
-fetchmail home page:
+fetchmail home page:
B. Copyright, License and Warranty
==================================
@@ -107,7 +107,7 @@ END OF fetchmail-SA-2005-02.txt
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
-iEYEARECAAYFAk9/Yg4ACgkQvmGDOQUufZWoPgCdG1P0n27En0VPMiY3+d0NSwfy
-4rgAn037UM4pEf7E94HZQOmGUR//pM6q
-=q8j6
+iEYEARECAAYFAlN9DK0ACgkQvmGDOQUufZUzEQCg4GOxtrGvWtdZG0NE99DMmPOY
+Tb8AnixEWIjzEr7D/FYxK3Hj2nl6f+pG
+=Dzx9
-----END PGP SIGNATURE-----
diff --git a/fetchmail-SA-2005-03.txt b/fetchmail-SA-2005-03.txt
index d6e2c4be..21c4b528 100644
--- a/fetchmail-SA-2005-03.txt
+++ b/fetchmail-SA-2005-03.txt
@@ -15,10 +15,10 @@ Danger: low
Credits: Daniel Drake, Gentoo (bug report)
Sunil Shetye (bug fix)
CVE Name: CVE-2005-4348
-URL: http://fetchmail.berlios.de/fetchmail-SA-2005-03.txt
+URL: http://fetchmail.sourceforge.net/fetchmail-SA-2005-03.txt
http://article.gmane.org/gmane.mail.fetchmail.user/7573
http://bugs.debian.org/343836
-Project URL: http://fetchmail.berlios.de/
+Project URL: http://fetchmail.sourceforge.net/
Affects: fetchmail version 6.2.5.4
fetchmail version 6.3.0
@@ -79,7 +79,7 @@ For sites, where multidrop mode is required, no workaround is known.
Download and install fetchmail 6.3.1 or a newer stable release from
fetchmail's project site at
-.
+.
The fix has also been backported to the 6.2.5.5 legacy release which is
available from the same site.
@@ -125,7 +125,7 @@ END OF fetchmail-SA-2005-03.txt
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
-iEYEARECAAYFAk9/Yg4ACgkQvmGDOQUufZWToACfZyLSqP8dWVIB6rX56d+Kr1sc
-iXEAoNszsDwKI1O5lh7R70etYL9jAtiq
-=Zz4j
+iEYEARECAAYFAlN9DK0ACgkQvmGDOQUufZVR6wCePBum0D/6j2Mmzc9eDttcckfu
+100AoJoy6OdYYvUDCfEjjog+aAo72NXI
+=L83l
-----END PGP SIGNATURE-----
diff --git a/fetchmail-SA-2006-01.txt b/fetchmail-SA-2006-01.txt
index 672b5510..34fc765c 100644
--- a/fetchmail-SA-2006-01.txt
+++ b/fetchmail-SA-2006-01.txt
@@ -14,9 +14,9 @@ Impact: fetchmail crashes
Danger: low
Credits: Nathaniel W. Turner (bug report)
CVE Name: CVE-2006-0321
-URL: http://fetchmail.berlios.de/fetchmail-SA-2006-01.txt
+URL: http://fetchmail.sourceforge.net/fetchmail-SA-2006-01.txt
http://bugs.debian.org/348747
-Project URL: http://fetchmail.berlios.de/
+Project URL: http://fetchmail.sourceforge.net/
Affects: fetchmail release >= 6.3.0
fetchmail release < 6.3.2
@@ -74,7 +74,7 @@ None known at this time.
Download and install fetchmail 6.3.2 or a newer stable release from
fetchmail's project site at
-.
+.
5. End of life announcement
@@ -115,7 +115,7 @@ END OF fetchmail-SA-2006-01.txt
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
-iEYEARECAAYFAk9/Yg4ACgkQvmGDOQUufZVnOgCfVyOBUSVgRSjBtqzjaLwKEg0K
-30YAoJiFeNUcNBO3oKfq5rMdSEeNAfGP
-=Gvze
+iEYEARECAAYFAlN9DK0ACgkQvmGDOQUufZUBxACdHYpE68rvXlETUZb+pwr7fJ2n
+dF0An2yoLVhY7KUENyxhnN57aQ0Ro6BK
+=66Zk
-----END PGP SIGNATURE-----
diff --git a/fetchmail-SA-2006-02.txt b/fetchmail-SA-2006-02.txt
index 19948947..92c189c2 100644
--- a/fetchmail-SA-2006-02.txt
+++ b/fetchmail-SA-2006-02.txt
@@ -14,8 +14,8 @@ Impact: fetchmail can expose cleartext password over unsecure link
Danger: medium
Credits: Isaac Wilcox (bug report, testing, collaboration on fix)
CVE Name: CVE-2006-5867
-URL: http://fetchmail.berlios.de/fetchmail-SA-2006-02.txt
-Project URL: http://fetchmail.berlios.de/
+URL: http://fetchmail.sourceforge.net/fetchmail-SA-2006-02.txt
+Project URL: http://fetchmail.sourceforge.net/
Affects: fetchmail releases <= 6.3.5
fetchmail release candidates 6.3.6-rc1, -rc2, -rc3
@@ -100,7 +100,7 @@ or equivalent in the run control file. This encrypts the whole session.
Download and install fetchmail 6.3.7 or a newer stable release from
fetchmail's project site at
-.
+.
5. Acknowledgments
@@ -138,7 +138,7 @@ END OF fetchmail-SA-2006-02.txt
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
-iEYEARECAAYFAk9/Yg4ACgkQvmGDOQUufZVAlACglBU+3L80GdwXRplGD0jLEPYp
-C8QAoJHEGU8xtgurUjt/mYiwz8u85vYY
-=Io6N
+iEYEARECAAYFAlN9DK0ACgkQvmGDOQUufZU41wCfaHJrbV3wTOWIYY6ExBcmboy1
+BC8AoOphRY3GVah+xgHg+mOjIPQ4eXeO
+=wjDV
-----END PGP SIGNATURE-----
diff --git a/fetchmail-SA-2006-03.txt b/fetchmail-SA-2006-03.txt
index fbdd9472..844fd9f7 100644
--- a/fetchmail-SA-2006-03.txt
+++ b/fetchmail-SA-2006-03.txt
@@ -13,8 +13,8 @@ Impact: fetchmail aborts prematurely
Danger: low
Credits: Neil Hoggarth (bug report and analysis)
CVE Name: CVE-2006-5974
-URL: http://fetchmail.berlios.de/fetchmail-SA-2006-03.txt
-Project URL: http://fetchmail.berlios.de/
+URL: http://fetchmail.sourceforge.net/fetchmail-SA-2006-03.txt
+Project URL: http://fetchmail.sourceforge.net/
Affects: fetchmail release = 6.3.5
fetchmail release candidates 6.3.6-rc1, -rc2
@@ -63,7 +63,7 @@ Avoid the mda option and ship to a local SMTP or LMTP server instead.
Download and install fetchmail 6.3.6 or a newer stable release from
fetchmail's project site at
-.
+.
@@ -94,7 +94,7 @@ END OF fetchmail-SA-2006-03.txt
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
-iEYEARECAAYFAk9/Yg4ACgkQvmGDOQUufZWnJACgxlN1s2Y3gO/Nap72VG7EaAyV
-PAEAoKChr5sNMsU9k9LJeYvMYOua7IC1
-=Vx/n
+iEYEARECAAYFAlN9DK0ACgkQvmGDOQUufZUF1wCgvRVApGvyCvrXg84xt4SLtHxe
+v34AoObhRk3Q95bukkY2sAMunVkBkV1q
+=IF8k
-----END PGP SIGNATURE-----
diff --git a/fetchmail-SA-2007-01.txt b/fetchmail-SA-2007-01.txt
index 5a09c5b9..2b3c1785 100644
--- a/fetchmail-SA-2007-01.txt
+++ b/fetchmail-SA-2007-01.txt
@@ -13,8 +13,8 @@ Impact: password disclosure possible
Danger: low
Credits: Gaëtan Leurent
CVE Name: CVE-2007-1558
-URL: http://fetchmail.berlios.de/fetchmail-SA-2007-01.txt
-Project URL: http://fetchmail.berlios.de/
+URL: http://fetchmail.sourceforge.net/fetchmail-SA-2007-01.txt
+Project URL: http://fetchmail.sourceforge.net/
Affects: fetchmail release < 6.3.8
@@ -76,7 +76,7 @@ C. If you must continue to use APOP without SSL/TLS, then install
fetchmail 6.3.8 or newer, as it is less susceptible to the attack by
validating the APOP challenge more strictly to make the attack
harder. The fetchmail 6.3.8 source code is available from
- .
+ .
A. Copyright, License and Warranty
@@ -107,7 +107,7 @@ END OF fetchmail-SA-2007-01.txt
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
-iEYEARECAAYFAk9/Yg4ACgkQvmGDOQUufZVn6wCgkC9pMA9HxXG6lgbgoixd73Tn
-Cz4AoKG+qB47vhGdXSTDDXDFgMDrMJ24
-=BKzz
+iEYEARECAAYFAlN9DK0ACgkQvmGDOQUufZXpcQCgxzyViEuWv9/kZ6aE8PvfeEev
+8ZsAoLQCAZbK1MHuP/FLeviuVOeHRxO1
+=FH2Q
-----END PGP SIGNATURE-----
diff --git a/fetchmail-SA-2007-02.txt b/fetchmail-SA-2007-02.txt
index c48ff70d..2a916472 100644
--- a/fetchmail-SA-2007-02.txt
+++ b/fetchmail-SA-2007-02.txt
@@ -12,7 +12,7 @@ Type: NULL pointer dereference trigged by outside circumstances
Impact: denial of service possible
Danger: low
CVSS V2 vector: (AV:N/AC:M/Au:N/C:N/I:N/A:C/E:?/RL:O/RC:C)
-
+
Credits: Earl Chew
CVE Name: CVE-2007-4565
URL: http://www.fetchmail.info/fetchmail-SA-2007-02.txt
@@ -48,25 +48,25 @@ control) files for fetchmail.
2. Problem description and Impact
=================================
-fetchmail will generate warning messages in certain circumstances and
-send them to the local postmaster or the user starting it. Such warning
-messages can be generated, for instance, if logging into an upstream
-server fails repeatedly or if messages beyond the size limit (if
+fetchmail will generate warning messages in certain circumstances and
+send them to the local postmaster or the user starting it. Such warning
+messages can be generated, for instance, if logging into an upstream
+server fails repeatedly or if messages beyond the size limit (if
configured, default: no limit) are left on the server.
-If this warning message is then refused by the SMTP listener that
-fetchmail is forwarding the message to, fetchmail attempts to
-dereference a NULL pointer when trying to find out if it should allow a
+If this warning message is then refused by the SMTP listener that
+fetchmail is forwarding the message to, fetchmail attempts to
+dereference a NULL pointer when trying to find out if it should allow a
bounce message to be sent.
-This causes fetchmail to crash and not collect further messages until it
+This causes fetchmail to crash and not collect further messages until it
is restarted.
-Risk assessment: low. In default configuration, fetchmail will talk
-through the loopback interface, that means to the SMTP server on the same
-computer as it is running on. Otherwise, it will commonly be configured
-to talk to trusted SMTP servers, so a compromise or misconfiguration of
-a trusted or the same computer is required to exploit this problem -
+Risk assessment: low. In default configuration, fetchmail will talk
+through the loopback interface, that means to the SMTP server on the same
+computer as it is running on. Otherwise, it will commonly be configured
+to talk to trusted SMTP servers, so a compromise or misconfiguration of
+a trusted or the same computer is required to exploit this problem -
which usually opens up much easier ways of denying service, or worse.
@@ -78,11 +78,11 @@ There are two alternatives, either of them by itself is sufficient:
a. Apply the patch found in section B of this announcement to fetchmail 6.3.8,
recompile and reinstall it.
-b. Install fetchmail 6.3.9 or newer when it becomes available. The
- fetchmail source code is available from
- .
+b. Install fetchmail 6.3.9 or newer when it becomes available. The
+ fetchmail source code is available from
+ .
-Note there are no workarounds presented here since all known workarounds
+Note there are no workarounds presented here since all known workarounds
are more intrusive than the actual solution.
@@ -119,7 +119,7 @@ Index: sink.c
+++ sink.c (revision 5119)
@@ -262,7 +262,7 @@
const char *md1 = "MAILER-DAEMON", *md2 = "MAILER-DAEMON@";
-
+
/* don't bounce in reply to undeliverable bounces */
- - if (!msg->return_path[0] ||
+ if (!msg || !msg->return_path[0] ||
@@ -131,7 +131,7 @@ END OF fetchmail-SA-2007-02.txt
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
-iEYEARECAAYFAk9/Yg4ACgkQvmGDOQUufZWWKwCfX4Ri89SzzUcXYxughs1CdnAk
-Z6IAniD4DzayVUR6UxA5K1OqX1CUDOhM
-=+YME
+iEYEARECAAYFAlN9DK0ACgkQvmGDOQUufZWetACggVJsyo1c2oL/Fjqi9Z/myw6j
+6eMAmgLJS8tWjBE7C5gdW3TLRQTUeFU8
+=9cUO
-----END PGP SIGNATURE-----
diff --git a/fetchmail-SA-2008-01.txt b/fetchmail-SA-2008-01.txt
index 025e5b66..3b6d9313 100644
--- a/fetchmail-SA-2008-01.txt
+++ b/fetchmail-SA-2008-01.txt
@@ -6,7 +6,7 @@ fetchmail-SA-2008-01: Crash on large log messages in verbose mode
Topics: Crash in large log messages in verbose mode.
Author: Matthias Andree
-Version: 1.2
+Version: 1.3
Announced: 2008-06-17
Type: Dereferencing garbage pointer triggered by outside circumstances
Impact: denial of service possible
@@ -28,7 +28,6 @@ Not affected: fetchmail release 6.3.9 and newer
Corrected: 2008-06-24 fetchmail SVN (rev 5205)
References:
-
0. Release history
@@ -38,7 +37,8 @@ References:
posted to oss-security)
2008-06-17 1.0 published on http://www.fetchmail.info/
2008-06-17 1.1 Corrected typo in Type: above (trigged -> triggered)
-2008-06-24 1.2 also fixed issue in report_complete (reported by Petr Uzel)
+2008-06-24 1.2 also fixed issue in report_complete (reported by Petr Uzel)
+2014-05-21 1.3 drop obsolete BerliOS link from References: in header above
1. Background
@@ -90,7 +90,7 @@ a. Apply the patch found in section B of this announcement to
b. Install fetchmail 6.3.9 or newer after it will have become available.
The fetchmail source code is always available from
- .
+ .
4. Workaround
@@ -196,7 +196,7 @@ END OF fetchmail-SA-2008-01.txt
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
-iEYEARECAAYFAk9/Yg4ACgkQvmGDOQUufZVbTACeOfZU3NVlDF675SDiVqPL4uAl
-fsgAoMEqf6cpav6sDdEobMHV3UzHSOJV
-=uvVR
+iEYEARECAAYFAlN9DK4ACgkQvmGDOQUufZV5ygCg6VQ+GzxusnaijUWIKKu29mQy
+wrMAoPHktP1LYWR3eJmoG8palU2lAM1L
+=C7We
-----END PGP SIGNATURE-----
diff --git a/fetchmail-SA-2009-01.txt b/fetchmail-SA-2009-01.txt
index eb50a9e8..f06cb1e2 100644
--- a/fetchmail-SA-2009-01.txt
+++ b/fetchmail-SA-2009-01.txt
@@ -85,7 +85,7 @@ a. Apply the patch found in section B of this announcement to
b. Install fetchmail 6.3.11 or newer after it will have become available.
The fetchmail source code is always available from
- .
+ .
4. Workaround
@@ -123,9 +123,9 @@ Use the information herein at your own risk.
B. Patch to remedy the problem
==============================
-Note that when taking this from a GnuPG clearsigned file, the lines
-starting with a "-" character are prefixed by another "- " (dash +
-blank) combination. Either feed this file through GnuPG to strip them,
+Note that when taking this from a GnuPG clearsigned file, the lines
+starting with a "-" character are prefixed by another "- " (dash +
+blank) combination. Either feed this file through GnuPG to strip them,
or strip them manually.
Whitespace differences can usually be ignored by invoking "patch -l",
@@ -176,7 +176,7 @@ END OF fetchmail-SA-2009-01.txt
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
-iEYEARECAAYFAk9/Yg4ACgkQvmGDOQUufZUQ7ACgheMkM4k7NLg6cz8ys3jk9C/P
-uxgAnRzc38wIDR+8Pio9CmDLheOcuskK
-=OYqf
+iEYEARECAAYFAlN9DK4ACgkQvmGDOQUufZWmFwCfUNG9bP8z+YxzM+JYN2YO8Rjr
+eAQAoKa732cxnsq5vUPUdhwZs5PRSNhL
+=2qIK
-----END PGP SIGNATURE-----
diff --git a/fetchmail-SA-2010-01.txt b/fetchmail-SA-2010-01.txt
index 0d75e88a..d665d211 100644
--- a/fetchmail-SA-2010-01.txt
+++ b/fetchmail-SA-2010-01.txt
@@ -80,7 +80,7 @@ a. Apply the patch found in section B of this announcement to
b. Install fetchmail 6.3.14 or newer after it will have become available.
The fetchmail source code is always available from
- .
+ .
4. Workaround
@@ -140,7 +140,7 @@ END OF fetchmail-SA-2010-01.txt
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
-iEYEARECAAYFAk9/Yg4ACgkQvmGDOQUufZX0pACg7jUxqFQzdhdVDXk/izXBNkfg
-ZBgAnAhDK4mYPoCzoiaJhEHM6rET4W+v
-=AX1N
+iEYEARECAAYFAlN9DK4ACgkQvmGDOQUufZXgLgCgj6+wbZzyaLBuNZ1rhounuoTb
+UCcAmgN9gAiisBhQRS1juUKx2tb/JBb1
+=uHuw
-----END PGP SIGNATURE-----
diff --git a/fetchmail-SA-2010-02.txt b/fetchmail-SA-2010-02.txt
index f1c17b75..6dd5c377 100644
--- a/fetchmail-SA-2010-02.txt
+++ b/fetchmail-SA-2010-02.txt
@@ -90,7 +90,7 @@ b. Install fetchmail 6.3.17 or newer after it will have become available.
(Note that the announcements may be publicly visible quite some time
before the release is made, particularly for minor bugs.)
The fetchmail source code is always available from
- .
+ .
4. Workaround
@@ -140,15 +140,15 @@ index 6f2dbf3..dbcda32 100644
+++ b/rfc822.c
@@ -25,6 +25,7 @@ MIT license. Compile with -DMAIN to build the demonstrator.
#include
-
+
#include "fetchmail.h"
+#include "sdump.h"
-
+
#ifndef MAIN
#include "i18n.h"
@@ -74,9 +75,10 @@ char *reply_hack(
}
-
+
#ifndef MAIN
- - if (outlevel >= O_DEBUG)
- - report_build(stdout, GT_("About to rewrite %.*s...\n"),
@@ -157,12 +157,12 @@ index 6f2dbf3..dbcda32 100644
+ report_build(stdout, GT_("About to rewrite %s...\n"), (cp = sdump(buf, BEFORE_EOL(buf))));
+ xfree(cp);
+ }
-
+
/* make room to hack the address; buf must be malloced */
for (cp = buf; *cp; cp++)
@@ -211,9 +213,12 @@ char *reply_hack(
}
-
+
#ifndef MAIN
- - if (outlevel >= O_DEBUG)
- - report_complete(stdout, GT_("...rewritten version is %.*s.\n"),
@@ -181,16 +181,16 @@ index fdc6f5d..9a62ee2 100644
- --- a/uid.c
+++ b/uid.c
@@ -20,6 +20,7 @@
-
+
#include "fetchmail.h"
#include "i18n.h"
+#include "sdump.h"
-
+
/*
* Machinery for handling UID lists live here. This is mainly to support
@@ -249,8 +250,11 @@ void initialize_saved_lists(struct query *hostlist, const char *idfile)
{
- report_build(stdout, GT_("Old UID list from %s:"),
+ report_build(stdout, GT_("Old UID list from %s:"),
ctl->server.pollname);
- - for (idp = ctl->oldsaved; idp; idp = idp->next)
- - report_build(stdout, " %s", idp->id);
@@ -247,7 +247,7 @@ index fdc6f5d..9a62ee2 100644
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
-iEYEARECAAYFAk9/Yg4ACgkQvmGDOQUufZVpfQCcD3U6m1MbJOFZV4FgI7e042vF
-HcEAn0j6ZFwp9dh2G7PJSkN9CM0XazyJ
-=JUs1
+iEYEARECAAYFAlN9DK4ACgkQvmGDOQUufZUKUACeOl0QLdcl48bttiIEOF5XKRCF
+wxQAnigEIYE6BlJQ17CSjZ4KfigM3oK6
+=culN
-----END PGP SIGNATURE-----
diff --git a/fetchmail-SA-2011-01.txt b/fetchmail-SA-2011-01.txt
index 26751311..aa811fa5 100644
--- a/fetchmail-SA-2011-01.txt
+++ b/fetchmail-SA-2011-01.txt
@@ -78,7 +78,7 @@ can be used as a workaround.
Install fetchmail 6.3.20 or newer.
The fetchmail source code is always available from
-.
+.
Distributors are encouraged to review the NEWS file and move forward to
6.3.20, rather than backport individual security fixes, because doing so
@@ -135,7 +135,7 @@ END of fetchmail-SA-2011-01
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
-iEYEARECAAYFAk9/Yg4ACgkQvmGDOQUufZUICACg5GqwtyAFuOamJ3JtribzMe9U
-k20AnRLlwx4HBC/Gk3AX1dWSrrQc8WYB
-=GFzg
+iEYEARECAAYFAlN9DK4ACgkQvmGDOQUufZWivQCgs1S3ZZHCnBN4bZHuiTwIIzmo
+hzYAoOr6wu0pYwyLhoBrfkHqFotE4mp2
+=XWx6
-----END PGP SIGNATURE-----
diff --git a/fetchmail-SA-2012-01.txt b/fetchmail-SA-2012-01.txt
index 47d12ae5..03dc4bcd 100644
--- a/fetchmail-SA-2012-01.txt
+++ b/fetchmail-SA-2012-01.txt
@@ -80,7 +80,7 @@ OpenSSL versions, please see .
Install fetchmail 6.3.22 or newer.
The fetchmail source code is always available from
-.
+.
Distributors are encouraged to review the NEWS file and move forward to
6.3.22, rather than backport individual security fixes, because doing so
@@ -120,7 +120,7 @@ END of fetchmail-SA-2012-01
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
-iEUEARECAAYFAlA+h6EACgkQvmGDOQUufZVxcQCWJ4Oza6u2OtWZErSf415uBneQ
-0gCfbaE1JSkrd0uXzwWDMAbBnSqY9lY=
-=2BVL
+iEYEARECAAYFAlN9DK4ACgkQvmGDOQUufZVCbwCgoQriSlTKD7T6wLSW/4nxvWan
+sGAAnRsgZqpyHgunCA8VUlUQNKO5Z4z1
+=nvvD
-----END PGP SIGNATURE-----
diff --git a/fetchmail-SA-2012-02.txt b/fetchmail-SA-2012-02.txt
index e0761f49..9783f696 100644
--- a/fetchmail-SA-2012-02.txt
+++ b/fetchmail-SA-2012-02.txt
@@ -71,7 +71,7 @@ other accounts' data.
Install fetchmail 6.3.22 or newer.
The fetchmail source code is always available from
-.
+.
Distributors are encouraged to review the NEWS file and move forward to
6.3.22, rather than backport individual security fixes, because doing so
@@ -111,7 +111,7 @@ END of fetchmail-SA-2012-02
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
-iEYEARECAAYFAlA+n3kACgkQvmGDOQUufZWzKwCfcOJF35eJ/bOio0VRfFFOiBsq
-dNwAnicBBiqQOq9i7atwBr4gdZ5x+SUM
-=+hqO
+iEYEARECAAYFAlN9DK4ACgkQvmGDOQUufZWDzACgkyvYcMCskG/b3cYoNKioRuZF
+kZcAn0OKGe0JuS88V9lrzRYAUme27zbh
+=ZMfO
-----END PGP SIGNATURE-----
diff --git a/fetchmail.man b/fetchmail.man
index ad412a53..03f6233b 100644
--- a/fetchmail.man
+++ b/fetchmail.man
@@ -10,7 +10,7 @@
.\" Load www macros to process .URL requests, this requires groff:
.mso www.tmac
.\"
-.TH fetchmail 1 "fetchmail 6.3.26" "fetchmail" "fetchmail reference manual"
+.TH fetchmail 1 "fetchmail 6.3.27" "fetchmail" "fetchmail reference manual"
.SH NAME
fetchmail \- fetch mail from a POP, IMAP, ETRN, or ODMR-capable server
@@ -62,7 +62,7 @@ env LC_ALL=C fetchmail \-vvv \-\-nodetach \-\-nosyslog
(This command line actually runs fetchmail with verbose English output.)
.PP
Also see
-.URL "http://fetchmail.berlios.de/fetchmail-FAQ.html#G3" "item #G3 in fetchmail's FAQ"
+.URL "http://fetchmail.sourceforge.net/fetchmail-FAQ.html#G3" "item #G3 in fetchmail's FAQ"
.PP
You can omit the LC_ALL=C part above if you want output in the local
language (if supported). However if you are posting to mailing lists,
@@ -2914,11 +2914,11 @@ The BSMTP error handling is virtually nonexistent and may leave broken
messages behind.
.PP
Send comments, bug reports, gripes, and the like to the
-.MTO "fetchmail-devel@lists.berlios.de" "fetchmail-devel list"
+.MTO "fetchmail-devel@lists.sourceforge.net" "fetchmail-devel list"
.PP
An
-.URL "http://fetchmail.berlios.de/fetchmail-FAQ.html" "HTML FAQ"
+.URL "http://fetchmail.sourceforge.net/fetchmail-FAQ.html" "HTML FAQ"
is available at the fetchmail home page, it should also accompany your
installation.
@@ -2956,7 +2956,10 @@ Beinert, and H\['e]ctor Garc\['i]a.
.BR netrc (5).
.PP
-.URL "http://fetchmail.berlios.de/" "The fetchmail home page."
+.URL "http://www.fetchmail.info/" "The fetchmail home page."
+
+.PP
+.URL "http://fetchmail.sourceforge.net/" "The fetchmail home page (alternative URI)."
.PP
.URL "http://www.courier-mta.org/maildrop/" "The maildrop home page."
diff --git a/specgen.sh b/specgen.sh
index e2448c12..a9c2767d 100755
--- a/specgen.sh
+++ b/specgen.sh
@@ -9,7 +9,7 @@ if [ -z "$version" ] ; then
exit 1
fi
-email="fetchmail-devel@lists.berlios.de"
+email="fetchmail-devel@lists.sourceforge.net"
packager="Fetchmail Developers <$email>"
rpmver=`echo "$version" | sed 's/-/./g'`
if test $rpmver = $version ; then
@@ -35,7 +35,7 @@ Version: $rpmver
Release: 1
Vendor: The Community Fetchmail Project
Packager: $packager
-URL: http://developer.berlios.de/projects/fetchmail
+URL: http://sourceforge.net/projects/fetchmail
Source: %{name}-${vervar}.tar.bz2
Group: Applications/Mail
Group(pt_BR): Aplicações/Correio Eletrônico
@@ -60,7 +60,7 @@ Summary(tr): POP2, POP3, APOP, IMAP protokolleri ile uzaktan mektup alma yazıl
Summary(vi): trình nền lấy thư POP/IMAP có tính năng đầy đủ
BuildRoot: %{_tmppath}/%{name}-root
#Keywords: mail, client, POP3, APOP, KPOP, IMAP, ETRN, ODMR, SMTP, ESMTP, GSSAPI, RPA, NTLM, CRAM-MD5, SASL
-#Destinations: fetchmail-users@lists.berlios.de, fetchmail-announce@lists.berlios.de
+#Destinations: fetchmail-users@lists.sourceforge.net, fetchmail-announce@lists.sourceforge.net
%description
Fetchmail is a free, full-featured, robust, and well-documented remote
diff --git a/todo.html b/todo.html
index 754942c2..751c65c4 100644
--- a/todo.html
+++ b/todo.html
@@ -35,7 +35,8 @@ that everyone can alter.
It has been reported that multidrop name matching fails when the
name to be matched contains a Latin-1 umlaut. Dollars to doughnuts
this is some kind of character sign-extension problem. Trouble is,
diff --git a/website/index.html b/website/index.html
index b7a14530..1b3f7d5c 100644
--- a/website/index.html
+++ b/website/index.html
@@ -168,16 +168,16 @@ a blanket.
There is a fetchmail-users list for help and other user discussion
of fetchmail. It's a MailMan list, which you can sign up for at
-fetchmail-users@lists.berlios.de.
+href="http://lists.sourceforge.net/mailman/listinfo/fetchmail-users">
+fetchmail-users@lists.sourceforge.net.
There is also a
fetchmail-devel list for people who want to discuss fixes and
improvements in fetchmail and help co-develop it. That one is at
-fetchmail-devel@lists.berlios.de.
+href="http://lists.sourceforge.net/mailman/listinfo/fetchmail-devel">
+fetchmail-devel@lists.sourceforge.net.
Finally, there is an announcements-only list,
-fetchmail-announce@lists.berlios.de.
Fetchmail originated as a program called popclient, written
@@ -185,11 +185,10 @@ by Carl Harris. In 1996, Eric
S. Raymond took over; he soon renamed the program to fetchmail after
adding IMAP support.
In 2004 a new team took over, led by Rob Funk, Graham Wilson, and Rob Funk,
+Graham Wilson, and Matthias Andree. Since then,
-Graham Wilson has retreated, and Sunil Shetye has
+Graham Wilson has retreated, and Sunil Shetye has
contributed several important pieces of code.