ANNOUNCE: fetchmail security announcement 2021-02 (CVE-2021-39272) - TLS bypass vulnerabilities ("NO STARTTLS")

--===============9207719098003235332==
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature"; boundary="ZnlwRXuiJfQo7tZ4"
Content-Disposition: inline


--ZnlwRXuiJfQo7tZ4
Content-Type: text/plain; charset=iso-8859-1
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

fetchmail-SA-2021-02: STARTTLS session encryption bypassing

Topics:		fetchmail fails to enforce an encrypted connection

Author:		Matthias Andree
Version:	0.9
Announced:	2021-08-26
Type:		failure to enforce configured security policy
Impact:		fetchmail continues an unencrypted connection,
		thus reading unauthenticated input and sending
		information unencrypted over its transport
Danger:		medium
Acknowledgment:	Andrew C. Aitchison for reporting this against fetchmail
		Damian Poddebniak, Fabian Ising, Hanno B=F6ck, and Sebastian=20
		Schinzel for their Usenix Security 21 paper NO STARTTLS

CVE Name:	CVE-2021-39272
URL:		https://www.fetchmail.info/fetchmail-SA-2021-02.txt
Project URL:	https://www.fetchmail.info/

Affects:	- fetchmail releases up to and including 6.4.21

Not affected:	- fetchmail releases 6.4.22 and newer

Corrected in:	2021-08-26	fetchmail 6.4.22.rc1 release candidate
		TBD		fetchmail 6.4.22 release tarball

0. History of this announcement
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D

2021-08-10	Andrew C. Aitchison contacts fetchmail maintainer with pointer=
=20
		to Usenix Security 21 paper by Damian Poddebniak et al.
2021-08-16	a simplified recommendation to configure --ssl where possible
		(see section 3b. below) to mitigate impact was sent to the=20
		 fetchmail mailing lists
2021-08-26 0.9	initial release along with fetchmail 6.4.22.rc1


1. Background
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D

fetchmail is a software package to retrieve mail from remote POP3, IMAP,
ETRN or ODMR servers and forward it to local SMTP, LMTP servers or
message delivery agents. fetchmail supports SSL and TLS security layers
through the OpenSSL library, if enabled at compile time and if also
enabled at run time, in both SSL/TLS-wrapped mode on dedicated ports as
well as in-band-negotiated "STARTTLS" and "STLS" modes through the
regular protocol ports.


2. Problem description and Impact
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D

fetchmail permits requiring that an IMAP or POP3 protocol exchange uses=20
a TLS-encrypted transport, in 6.4 by way of an --sslproto auto or similar=
=20
configuration.
  This TLS encryption can be established either as Implicit TLS connection,
which negotiates TLS first, or as a STARTTLS which starts as cleartext
protocol exchange that gets upgraded in the same TCP stream to TLS.

Without special configuration, fetchmail would opportunistically try to
upgrade cleartext connections to TLS by STARTTLS, but allow cleartext proto=
col=20
exchange, which is documented.

IMAP also supports sessions that start in "authenticated state" (PREAUTH).
In this latter case, IMAP (RFC-3501) does not permit sending STARTTLS=20
negotiations, which are only permissible in not-authenticated state.
  In such a combination of circumstances (1. IMAP protocol in use, 2. the=
=20
server greets with PREAUTH, announcing authenticated state, 3. the user=20
configured TLS mandatory, 4. the user did not configure "ssl" mode that use=
s=20
separate ports for Implicit SSL/TLS), fetchmail 6.4.21 and older would
not encrypt the session.

There was a similar situation for POP3: if the remote name contained=20
@compuserve.com, and if the server supported a non-standard "AUTH" command=
=20
without mechanism argument and if it responded with a list that contained "=
RPA"=20
(also in mixed or lower case), then fetchmail would not attempt STARTTLS. =
=20
While the password itself is then protected by the RPA scheme (which employ=
s=20
MD5 however), fetchmail 6.4.21 and older would not encrypt the session.

Also, a configuration containing --auth ssh (meaning that fetchmail should =
not=20
authenticate, on the assumption that the session will be pre-authenticated =
for=20
instance through SSH running a mail server with --plugin, or TLS client=20
certificates), would also defeat STARTTLS as result of an implementation de=
fect.
This affected both POP3 and IMAP.


3. Solutions
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D

PREFACE: distributors backporting fixes to old versions are asked to diff t=
he=20
manual page and review the changes, and the NEWS file, because the manual p=
age=20
has been updated with newer recommendations.  The same backport recommendat=
ions=20
hold for the README.SSL file.


3a. Install fetchmail 6.4.22 or newer.

The fetchmail source code is available from
<https://sourceforge.net/projects/fetchmail/files/>.

The Git-based source code repository is currently published via
https://gitlab.com/fetchmail/fetchmail/-/tree/legacy_64 (primary)
https://sourceforge.net/p/fetchmail/git/ci/legacy_64/tree/ (copy)


3b. Where the IMAP or POP3 server supports this form of access,
fetchmail can be configured to use Implicit TLS, called "ssl" mode, meaning=
 it=20
will connect to a dedicated port (default: 993 for IMAP, 995 for POP3) and=
=20
negotiate TLS without prior clear-text protocol exchange.
  Also, --ssl can be given on the command line, which switches all
configured server statements to this Implicit TLS mode.


A. Copyright, License and Non-Warranty
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D

(C) Copyright 2021 by Matthias Andree, <[email protected]>.
Some rights reserved.

=A9 Copyright 2021 by Matthias Andree. This file is licensed under CC
BY-ND 4.0. To view a copy of this license, visit
http://creativecommons.org/licenses/by-nd/4.0/

THIS WORK IS PROVIDED FREE OF CHARGE AND WITHOUT ANY WARRANTIES.
Use the information herein at your own risk.

END of fetchmail-SA-2021-02

--ZnlwRXuiJfQo7tZ4
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEE3EplW9mTzUhx+oIQ5BKxVu/zhVoFAmEoFkgACgkQ5BKxVu/z
hVprTxAAoWGU7qk8ZXhmNoEi8XhsIiXk4Pe0AlWr0M2EHpnYO3Yzi0kVxaxIceXN
3cAsuK4pZwmFnDwVXggZDLRk5TaIj1eGA16Byp0rbS60cbYsisHMpGTTr5D+hQcx
lb9PvVl4D5fm/ahAUlRDlhSSOmNh3jG4HEYitTJDMuIireROg8ZPCSixBsN350r6
REXcu8RB+Ktn7a4PCJZgtyGZOxR5QgWT1+GkGdddlbraS31wIKfR//pINxKOtE4m
dJXCoSpBqoRcFkVplQZLMpWdcjI6ssz7OBYU+qmT/XjosE6CHy077+EPKkNiMi6K
DNbC0gQekHV2VbMGOphd+w1AWzdAJUOYfQcpwfNlqfvjrOxH5alPyf8WgzbBr1Ag
SBNpBScTGtQoXBNexDo5TX9g1qV2vUMDLJ5zEDSMLLC2t6c7nDxQ8UmFWFPOEPVJ
/JvYnWhLnMEyaJwU8gVVOgK5xsGYtjHSRKW9R5BvgJxo7CF5cpqsvXBhgGApLNBY
PkkJtLv8y8gRe8HdPN2n8hxcZsj6Ay5XMLXCDbKO5ze/XNOVzbiW3iCSASPys6PK
2sJH0+h0DKaIEk+Wh7F84V1j5Ok3iHMN7dCZzV/j5FSxVjFoJ/DzGyWBX5uUbrHH
znL/7ysQv26YjVW9tAN1VOWHIw3mYbz3WxMFIZUvguLWEWYik2k=
=T1MK
-----END PGP SIGNATURE-----

--ZnlwRXuiJfQo7tZ4--


--===============9207719098003235332==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline


--===============9207719098003235332==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Fetchmail-announce mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/fetchmail-announce

--===============9207719098003235332==--