[fetchmail-users] fetchmail 6.3.8 security fix release

[Matthias A. <mat...@gm...>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Greetings,

I am announcing the release of fetchmail 6.3.8. This new stable version
of fetchmail strengthens the APOP validator to make the
man-in-the-middle attack to be presented as CVE-2007-1558 more
difficult. It also fixes a regression from the 6.3.6 security patches
and further long-standing bugs.

Note that 6.3.8 is the last planned release on the 6.3 branch, further
planned fetchmail releases will take some time to appear and contain
larger changes.

The software is available from:
<http://developer.berlios.de/project/showfiles.php?group_id=1824>

The fetchmail home pages are:
<http://www.fetchmail.info/>  or  <http://fetchmail.berlios.de/>

These are the relevant changes in 6.3.8 since 6.3.7;
unless otherwise noted, changes to this release were made by Matthias Andree:

# ADVANCE WARNING OF FEATURES TO BE REMOVED OR CHANGED IN FUTURE VERSIONS
(There are no plans to remove these features from a 6.3.X release, but they may
be removed from a 6.4.0 or newer release.)
* The MX and host alias DNS lookups that fetchmail performs in multidrop mode
  are based on assumptions that are rarely met in practice, somewhat defective,
  deprecated and may be removed from a future fetchmail version.  They have
  never supported IPv6 (including IPv6-mapped IPv4).
  Non-DNS based alias keywords such as "aka" will remain in fetchmail.
* The monitor and interface options may be removed from a future fetchmail
  version as they are not reasonably portable.
* POP2 is obsolete, support will be removed from a future fetchmail version.
* RPOP is obsolete, support will be removed from a future fetchmail release.
* --sslcertck will become a default setting in a future fetchmail version.
* The multidrop To/Cc guessing code along with the fragile duplicate suppressor
  is deprecated and may be removed from a future release.
* The "envelope Received" option may be removed from a future release, because
  the Received header was never meant to be machine-readable, the format varies
  widely, and various other differences in behavior make parsing Received an
  unreliable undertaking. The envelope option as such will remain though, in
  order to support Delivered-To, X-Envelope-To, X-Original-To and similar.
  See also <http://home.pages.de/~mandree/mail/multidrop>.
* The --enable-fallback (fall back to MDA if MTA unavailable) will be removed
  from a future fetchmail release, because it makes fetchmail's behavior
  inconsistent and confusing.
* The "protocol auto" default inside fetchmail may be removed from a future
  fetchmail release. Explicit configuration of the protocol is recommended.
* Kerberos IV support may be removed from a future fetchmail release.
* SIGHUP wakeup support may be removed from a future fetchmail release and
  cause fetchmail to terminate - it was broken for many years.
* Support for operating systems that are not sufficiently POSIX compliant may be
  removed or operation on such systems may be suboptimal for future releases.

# SECURITY STRENGTHENING:
* Make the APOP challenge parser more distrustful and have it reject challenges
  that do not conform to RFC-822 msg-id format, in the hope to make mounting
  man-in-the-middle attacks (MITM) against APOP a bit more difficult.
  (CVE-2007-1558, reported by Gaëtan Leurent, published 2007-04-02 on Bugtraq)

  APOP is claimed insecure by Gaëtan Leurent for MITM scenarios for typical
  setups: based on MD5 collisions, it is purportedly possible to recover the
  first three characters of the shared secret (password), which would then make
  recovery of the shared secret a matter of hours or minutes; this would then
  enable the attacker to impersonate the client vis-à-vis the server.

  For further details, check
  * Gaëtan Leurent, "Message Freedom in MD4 and MD5 Collisions: Application
  to APOP", Fast Software Encryption 2007, Luxembourg. (Proceedings to appear in
  Springer's Lecture Notes on Computer Science.)
  * The mailing list discussion thread at
  <http://lists.berlios.de/pipermail/fetchmail-devel/2007-March/000887.html>

# BUG FIXES:
* Fix pluralization of oversized-message warning mails.
* Fix manual page: --sslcheck -> --sslcertck, and do not set trailing 
  "recommended:" in bold. Fixes Debian Bug #413059, reported by Rafal Czlonka.
* Repoll immediately if a protocol error happens during the authentication 
  attempt after a failed opportunistic TLS upgrade.
  Fixes comment #9 in Gentoo Bug #163782, reported by Takuto Matsuu.
* Fix rendering of the "24 - 26, 28, 29" paragraph in the exit codes section. 
  Reported by Nico Golde.
* If SOCKS support was compiled in, add 'socks' to the feature_options Python
  list emitted in --configdump. Reported by Rob MacGregor.
* Do not crash with a null pointer dereference when opening the BSMTP file 
  fails. Improve error checking and reporting. Reported by Reto Schüttel,
  Debian Bug#416625. Fix based on a patch by Nico Golde.
* Make BSMTP output actually work, it would persistently fail with SOCKET error
  after writing the first header. Bug independently found and reported in
  excellent detail by Reto Schüttel, Debian Bug#416812.

# DOCUMENTATION:
* Add fetchmail-SA-2007-01.txt
* Extend --mda documentation, discourage use of qmail-inject.
  Based on a patch by Rob MacGregor.
* Document SOCKS configuration facility (SOCKS_CONF environment variable).
  Thanks to Jochen Hayek, Michael Shuldman and Rob MacGregor.
* Use envelope option in multidrop example. Patch by Rob MacGregor.
* Document expected Received: line format when parsing for envelope addressees.
* Stripped option documentation from sample.rcfile, since this is bound to go
  out of synch with the manual page, which is the only reference on options.
* Mention that --limit default is 0 bytes, which is special for "no limit".
* Corrected Robert M. Funk's name that I misspelled. My sincere apologies
  -- Matthias Andree.

# CONTRIB:
* Add delete-later and delete-later.README, a script and documentation for
  a MySQL/Tcl-based client-side "delete-after" feature.
  Kindly donated by Yoo GmbH, Großvoigtsberg, Germany (Carsten Ralle).

# KNOWN BUGS AND WORKAROUNDS:
  (this section floats upwards through the NEWS file so it stays with the
  current release information)
* fetchmail does not handle messages without Message-ID header well
  (See sourceforge.net bug #780933)
* BSMTP is mostly untested and errors can cause corrupt output.
* Sun Workshop 6 (SPARC) is known to miscompile the configuration file lexer in
  64-bit mode.  Either compile 32-bit code or use GCC to compile 64-bit
  fetchmail.  Note that fetchmail doesn't take advantage of 64-bit code,
  so compiling 32-bit SPARC code should not cause any difficulties.
* fetchmail does not track pending deletes over crashes
* the command line interface is a bit narrow-minded sometimes, for instance,
  fetchmail -s doesn't work with a running daemon
* some of the logging output is not very helpful
* some of the documentation is still not up to date

- -- 
Matthias Andree
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (GNU/Linux)

iD8DBQFGFq68vmGDOQUufZURAidjAKCG9+TAjmMz7l/9KWFROKBqhyBLPgCg9hbo
KAMMlF17J1XRbB/rGR9uiSA=
=orbA
-----END PGP SIGNATURE-----