Vipul Razor Agents (razor-agents) before 2.70 allows remote attackers to cause a denial of service via (1) certain "unusual HTML messages" or (2) "certain malformed headers" such as Content-Type.

This advisory adds security support for the stable amd64 distribution.
It covers all security updates since the release of sarge, which were missing updated packages for the not yet official amd64 port. Future security advisories will include updates for this port as well.

A vulnerability was discovered in the way that Razor parses certain email headers that could potentially be used to crash the Razor program, causing a denial of service.

The remote host is affected by the vulnerability described in GLSA-200506-17 (SpamAssassin 3, Vipul's Razor: Denial of Service vulnerability)

    SpamAssassin and Vipul's Razor contain a Denial of Service     vulnerability when handling special misformatted long message headers.
  Impact :

    By sending a specially crafted message an attacker could cause a Denial     of Service attack against the SpamAssassin/Vipul's Razor server.
  Workaround :

    There is no known workaround at this time.

The remote host is running the razor-agent, a distributed client that connects to the razor spam detection and filtering network.  This version of Razor-agent is vulnerable to a remote Denial of Service (DoS) attack via a malformed query.  The details of the attack vectors are not currently known

ID	Name	Product	Family	Severity
57528	Debian DSA-773-1 : amd64 - several vulnerabilities	Nessus	Debian Local Security Checks	critical
18630	Debian DSA-738-1 : razor - remote denial of service	Nessus	Debian Local Security Checks	medium
18538	GLSA-200506-17 : SpamAssassin 3, Vipul's Razor: Denial of Service vulnerability	Nessus	Gentoo Local Security Checks	medium
3020	Razor-agents < 2.72 Multiple DoS	Nessus Network Monitor	Generic	medium

Detections

Analytics

CVE-2005-2024

high

Tenable Plugins

critical

medium

medium

medium