SpamAssassin 3.1.x, 3.2.0, and 3.2.1 before 20070611, when running as root in unusual configurations using vpopmail or virtual users, allows local users to cause a denial of service (corrupt arbitrary files) via a symlink attack on a file that is used by spamd.

From Red Hat Security Advisory 2007:0492 :

Updated spamassassin packages that fix a security issue are now available for Red Hat Enterprise Linux 4 and 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

SpamAssassin provides a way to reduce unsolicited commercial email (spam) from incoming email.

Martin Krafft discovered a symlink issue in SpamAssassin that affects certain non-default configurations. A local user could use this flaw to create or overwrite files writable by the spamd process (CVE-2007-2873).

Users of SpamAssassin should upgrade to these updated packages which contain a backported patch to correct this issue.

Note: This issue did not affect the version of SpamAssassin shipped with Red Hat Enterprise Linux 3.

Martin Krafft discovered a symlink issue in SpamAssassin that affects certain non-default configurations. A local user could use this flaw to create or overwrite files writable by the spamd process (CVE-2007-2873).

Local symlink vulnerability. Fedora is not vulnerable in any default or common configurations. Read upstream's announcement for details.

http://spamassassin.apache.org/advisories/CVE-2007-2873.txt

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

SpamAssassin 3.1.x, when running as root with unusual configuration options using vpopmail or virtual users, could allow local users to cause a denial of service (via corrupting arbitrary files) using a symlink attack on a file used by spamd.

SpamAssassin 3.1.9, which corrects this flaw, is provided with this update.

SpamAssassin website reports :

A local user symlink-attack DoS vulnerability in SpamAssassin has been found, affecting versions 3.1.x, 3.2.0, and SVN trunk.

Updated spamassassin packages that fix a security issue are now available for Red Hat Enterprise Linux 4 and 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

SpamAssassin provides a way to reduce unsolicited commercial email (spam) from incoming email.

Martin Krafft discovered a symlink issue in SpamAssassin that affects certain non-default configurations. A local user could use this flaw to create or overwrite files writable by the spamd process (CVE-2007-2873).

Users of SpamAssassin should upgrade to these updated packages which contain a backported patch to correct this issue.

Note: This issue did not affect the version of SpamAssassin shipped with Red Hat Enterprise Linux 3.

The remote host is running SpamAssassin, an anti-spam software application that detects and blocks spam emails.  This version of SpamAssassin is vulnerable to a flaw in that by creating a symbolic link, local attackers can cause the application to process a malformed file.  Successful exploitation results in the application crashing and denying valid services to users.

ID	Name	Product	Family	Severity
67521	Oracle Linux 4 / 5 : spamassassin (ELSA-2007-0492)	Nessus	Oracle Linux Local Security Checks	low
60207	Scientific Linux Security Update : spamassassin on SL5.x, SL4.x i386/x86_64 (fwd)	Nessus	Scientific Linux Local Security Checks	low
27663	Fedora 7 : spamassassin-3.2.1-1.fc7 (2007-0390)	Nessus	Fedora Local Security Checks	low
25537	Mandrake Linux Security Advisory : spamassassin (MDKSA-2007:125)	Nessus	Mandriva Local Security Checks	low
25533	FreeBSD : p5-Mail-SpamAssassin -- local user symlink-attack DoS vulnerability (8092b820-1d6f-11dc-a0b2-001921ab2fa4)	Nessus	FreeBSD Local Security Checks	low
25527	CentOS 4 / 5 : spamassassin (CESA-2007:0492)	Nessus	CentOS Local Security Checks	low
4100	SpamAssassin < 3.2.1 spamd Symlink Local DoS	Nessus Network Monitor	SMTP Clients	low
25521	RHEL 4 / 5 : spamassassin (RHSA-2007:0492)	Nessus	Red Hat Local Security Checks	low

Detections

Analytics

CVE-2007-2873

medium

Tenable Plugins

low

low

low

low

low

low

low

low