Apache SpamAssassin before 3.1.8 allows remote attackers to cause a denial of service via long URLs in malformed HTML, which triggers "massive memory usage."

From Red Hat Security Advisory 2007:0074 :

Updated spamassassin packages that fix a security issue are now available for Red Hat Enterprise Linux 4.

This update has been rated as having important security impact by the Red Hat Security Response Team.

SpamAssassin provides a way to reduce unsolicited commercial email (spam) from incoming email.

A flaw was found in the way SpamAssassin processes HTML email containing URIs. A carefully crafted mail message could cause SpamAssassin to consume significant resources. If a number of these messages are sent, this could lead to a denial of service, potentially delaying or preventing the delivery of email. (CVE-2007-0451)

Users of SpamAssassin should upgrade to these updated packages which contain version 3.1.8 which is not vulnerable to these issues.

This is an upgrade from SpamAssassin version 3.0.6 to 3.1.8, which contains many bug fixes and spam detection enhancements. Further details are available in the SpamAssassin 3.1 changelog and upgrade guide.

This upgrade brings spamassassin to version 3.1.8 with following changes :

  - fix for CVE-2007-0451: possible DoS due to incredibly     long URIs found in the message content.

  - disable perl module usage in update channels unless

    -allowplugins is specified

  - files with names starting/ending in whitespace weren't     usable

  - remove Text::Wrap related code due to upstream issues

  - update spamassassin and sa-learn to better deal with     STDIN

  - improvements and bug fixes related to DomainKeys and     DKIM support

  - several updates for Received header parsing

  - several documentation updates and random taint-variable     related issues

This update also adds some missing dependencies.

This upgrade brings spamassassin to version 3.1.8 with following changes :

  - fix for CVE-2007-0451: possible DoS due to incredibly     long URIs found in the message content.

  - disable perl module usage in update channels unless

    --allowplugins is specified

  - files with names starting/ending in whitespace weren't     usable

  - remove Text::Wrap related code due to upstream issues

  - update spamassassin and sa-learn to better deal with     STDIN

  - improvements and bug fixes related to DomainKeys and     DKIM support

  - several updates for Received header parsing

  - several documentation updates and random taint-variable     related issues

This update also adds some missing dependencies.

Updated spamassassin packages that fix a security issue are now available for Red Hat Enterprise Linux 5.

This update has been rated as having important security impact by the Red Hat Security Response Team.

SpamAssassin provides a way to reduce unsolicited commercial email (spam) from incoming email.

A flaw was found in the way SpamAssassin processes HTML email containing URIs. A carefully crafted mail message could cause SpamAssassin to consume significant resources. If a number of these messages are sent, this could lead to a denial of service, potentially delaying or preventing the delivery of email. (CVE-2007-0451)

Users of SpamAssassin should upgrade to these updated packages which contain version 3.1.8 which is not vulnerable to these issues.

The remote host is affected by the vulnerability described in GLSA-200703-02 (SpamAssassin: Long URI Denial of Service)

    SpamAssassin does not correctly handle very long URIs when scanning     emails.
  Impact :

    An attacker could cause SpamAssassin to consume large amounts of CPU     and memory resources by sending one or more emails containing very long     URIs.
  Workaround :

    There is no known workaround at this time.

A bug in the way that SpamAssassin processes HTML emails containing URIs was discovered in versions 3.1.x. A carefully crafted mail message could make SpamAssassin consume significant amounts of CPU resources that could delay or prevent the delivery of mail if a number of these messages were sent at once.

SpamAssassin has been upgraded to version 3.1.8 to correct this problem, and other upstream bugs. In addition, an invalid path setting in local.cf for the auto_whitelist_path has been fixed for Mandriva 2007.0.

Updated spamassassin packages that fix a security issue are now available for Red Hat Enterprise Linux 4.

This update has been rated as having important security impact by the Red Hat Security Response Team.

SpamAssassin provides a way to reduce unsolicited commercial email (spam) from incoming email.

A flaw was found in the way SpamAssassin processes HTML email containing URIs. A carefully crafted mail message could cause SpamAssassin to consume significant resources. If a number of these messages are sent, this could lead to a denial of service, potentially delaying or preventing the delivery of email. (CVE-2007-0451)

Users of SpamAssassin should upgrade to these updated packages which contain version 3.1.8 which is not vulnerable to these issues.

This is an upgrade from SpamAssassin version 3.0.6 to 3.1.8, which contains many bug fixes and spam detection enhancements. Further details are available in the SpamAssassin 3.1 changelog and upgrade guide.

This upgrades to version 3.1.8, which fixes some bugs and CVE-2007-0451 Malformed HTML Denial of Service.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is running SpamAssassin, an anti-spam software application that detects and blocks spam emails.  Due to a content-parsing error, SpamAssassin can be crashed when processing very long URIs within an email message.  An attacker exploiting this flaw would only need to have the ability to craft and send an email.  Successful exploitation leads to a loss of availability.

ID	Name	Product	Family	Severity
67450	Oracle Linux 4 : spamassassin (ELSA-2007-0074)	Nessus	Oracle Linux Local Security Checks	medium
29581	SuSE 10 Security Update : SPAMAssassin (ZYPP Patch Number 3078)	Nessus	SuSE Local Security Checks	medium
27451	openSUSE 10 Security Update : spamassassin (spamassassin-3077)	Nessus	SuSE Local Security Checks	medium
25316	RHEL 5 : spamassassin (RHSA-2007:0075)	Nessus	Red Hat Local Security Checks	medium
24750	GLSA-200703-02 : SpamAssassin: Long URI Denial of Service	Nessus	Gentoo Local Security Checks	medium
24706	Mandrake Linux Security Advisory : spamassassin (MDKSA-2007:049)	Nessus	Mandriva Local Security Checks	medium
24702	CentOS 4 : spamassassin (CESA-2007:0074)	Nessus	CentOS Local Security Checks	medium
24696	RHEL 4 : spamassassin (RHSA-2007:0074)	Nessus	Red Hat Local Security Checks	medium
24361	Fedora Core 5 : spamassassin-3.1.8-1.fc5 (2007-242)	Nessus	Fedora Local Security Checks	medium
24360	Fedora Core 6 : spamassassin-3.1.8-1.fc6 (2007-241)	Nessus	Fedora Local Security Checks	medium
3918	SpamAssassin < 3.1.8 Malformed HTML Long URI DoS	Nessus Network Monitor	SMTP Clients	medium

Detections

Analytics

CVE-2007-0451

high

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium