CVE-2005-3088: fetchmailconf before 1.49 in fetchmail 6.2.0, 6.2.5 and 6.2.5.2 creates configuration files with insecure w...

Security readout for executives and security teams

This issue can expose email account passwords on affected systems. A configuration helper for fetchmail created files that other local users could read. The business risk is credential theft from shared or compromised hosts, not a remote takeover by itself. Exposure is most likely on Unix-like systems where fetchmailconf was used to generate fetchmail configuration files, especially multi-user servers or endpoints with local shell access. Single-user systems have lower practical exposure unless another local compromise exists. Treat this as a targeted credential exposure issue. Prioritize shared servers and systems with stored mailbox passwords, then rotate affected credentials after confirming insecure file permissions or vulnerable package versions. Mitigation focus: Upgrade using vendor guidance for fetchmail or fetchmailconf packages.; Ensure fetchmailconf is version 1.49 or later where applicable.; Restrict fetchmail configuration files to the owning user only..

Prepared

Jun 29, 2026, 17:15 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.