SpamAssassin before 3.1.3, when running with vpopmail and the paranoid (-P) switch, allows remote attackers to execute arbitrary commands via a crafted message that is not properly handled when invoking spamd with the virtual pop username.

This update fixes the following security problem in SpamAssassin :

  - CVE-2006-2447: SpamAssassin when running with vpopmail     and the paranoid (-P) switch, allows remote attackers to     execute arbitrary commands via a crafted message that is     not properly handled when invoking spamd with the     virtual pop username.

At the same time we upgraded SpamAssassin to version 3.1.3, bringing lots of bug fixes and new rules.

Please make sure you verify that it still works with your configuration.

Also included is now 'sa-update', a rule update script. For this script to work make sure that the perl-IO-ZLib and perl-libwww-perl packages are installed.

Local symlink vulnerability. Fedora is not vulnerable in any default or common configurations. Read upstream's announcement for details.

http://spamassassin.apache.org/advisories/CVE-2007-2873.txt

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This upgrades to version 3.1.8, which fixes some bugs and CVE-2007-0451 Malformed HTML Denial of Service.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

3.1.3 Resolves CVE-2006-2447.

Note that you are affected by this bug only if you launched spamd with both --vpopmail and --paranoid, which is not a common configuration. 

Also included are bug fixes from 3.1.2.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A vulnerability has been discovered in SpamAssassin, a Perl-based spam filter using text analysis, that can allow remote attackers to execute arbitrary commands. This problem only affects systems where spamd is reachable via the internet and used with vpopmail virtual users, via the '-v' / '--vpopmail' switch, and with the '-P' / '--paranoid' switch which is not the default setting on Debian.

Updated spamassassin packages that fix an arbitrary code execution flaw are now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

SpamAssassin provides a way to reduce unsolicited commercial email (SPAM) from incoming email.

A flaw was found with the way the Spamassassin spamd daemon processes the virtual pop username passed to it. If a site is running spamd with both the --vpopmail and --paranoid flags, it is possible for a remote user with the ability to connect to the spamd daemon to execute arbitrary commands as the user running the spamd daemon.
(CVE-2006-2447)

Note: None of the IMAP or POP servers shipped with Red Hat Enterprise Linux 4 support vpopmail delivery. Running spamd with the --vpopmail and --paranoid flags is uncommon and not the default startup option as shipped with Red Hat Enterprise Linux 4.

Spamassassin, as shipped in Red Hat Enterprise Linux 4, performs RBL lookups against visi.com to help determine if an email is spam.
However, this DNS RBL has recently disappeared, resulting in mail filtering delays and timeouts.

Users of SpamAssassin should upgrade to these updated packages containing version 3.0.6 and backported patches, which are not vulnerable to these issues.

A flaw was discovered in the way that spamd processes the virtual POP usernames passed to it. If running with the --vpopmail and --paranoid flags, it is possible for a remote user with the ability to connect to the spamd daemon to execute arbitrary commands as the user running spamd.

By default, the Spamassassin packages do not start spamd with either of these flags and this usage is uncommon.

The updated packages have been patched to correct this issue.

The remote host is affected by the vulnerability described in GLSA-200606-09 (SpamAssassin: Execution of arbitrary code)

    When spamd is run with both the '--vpopmail' (-v) and     '--paranoid' (-P) options, it is vulnerable to an unspecified issue.
  Impact :

    With certain configuration options, a local or even remote     attacker could execute arbitrary code with the rights of the user     running spamd, which is root by default, by sending a crafted message     to the spamd daemon. Furthermore, the attack can be remotely     performed if the '--allowed-ips' (-A) option is present and specifies     non-local adresses. Note that Gentoo Linux is not vulnerable in the     default configuration.
  Workaround :

    Don't use both the '--paranoid' (-P) and the '--vpopmail' (-v)     options.

The remote host is running SpamAssassin, an anti-spam software application that detects and blocks spam emails.  Due to a content-parsing error, SpamAssassin can be tricked into executing arbitrary commands with the privileges of the SpamAssassin spamd process.  Additionally, the remote version of SpamAssassin must be running with either '--vpopmail' or '--paranoid' enabled.

The remote host is running spamd, a daemon belonging to SpamAssassin and used to determine whether messages represent spam. 

The installed version of spamd on the remote host appears to allow an unauthenticated user to execute arbitrary commands, subject to the privileges of the user under which it operates.

ID	Name	Product	Family	Severity
27449	openSUSE 10 Security Update : spamassassin (spamassassin-1904)	Nessus	SuSE Local Security Checks	medium
25509	Fedora Core 5 : spamassassin-3.1.9-1.fc5.1 (2007-584)	Nessus	Fedora Local Security Checks	medium
24361	Fedora Core 5 : spamassassin-3.1.8-1.fc5 (2007-242)	Nessus	Fedora Local Security Checks	medium
24118	Fedora Core 5 : spamassassin-3.1.3-1.fc5 (2006-598)	Nessus	Fedora Local Security Checks	medium
22632	Debian DSA-1090-1 : spamassassin - programming error	Nessus	Debian Local Security Checks	medium
21999	CentOS 4 : spamassassin (CESA-2006:0543)	Nessus	CentOS Local Security Checks	medium
21718	Mandrake Linux Security Advisory : spamassassin (MDKSA-2006:103)	Nessus	Mandriva Local Security Checks	medium
21702	GLSA-200606-09 : SpamAssassin: Execution of arbitrary code	Nessus	Gentoo Local Security Checks	medium
3640	SpamAssassin spamd vpopmail Username Command Injection	Nessus Network Monitor	SMTP Clients	medium
21673	SpamAssassin spamd Crafted Message Arbitrary Command Execution	Nessus	Gain a shell remotely	medium
21672	RHEL 4 : spamassassin (RHSA-2006:0543)	Nessus	Red Hat Local Security Checks	medium

Detections

Analytics

CVE-2006-2447

critical

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium