A denial of service vulnerability was identified that exists in Apache SpamAssassin before 3.4.2. The vulnerability arises with certain unclosed tags in emails that cause markup to be handled incorrectly leading to scan timeouts. In Apache SpamAssassin, using HTML::Parser, we setup an object and hook into the begin and end tag event handlers In both cases, the "open" event is immediately followed by a "close" event - even if the tag *does not* close in the HTML being parsed. Because of this, we are missing the "text" event to deal with the object normally. This can cause carefully crafted emails that might take more scan time than expected leading to a Denial of Service. The issue is possibly a bug or design decision in HTML::Parser that specifically impacts the way Apache SpamAssassin uses the module with poorly formed html. The exploit has been seen in the wild but not believed to have been purposefully part of a Denial of Service attempt. We are concerned that there may be attempts to abuse the vulnerability in the future.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - spamassassin: Local user code injection in the meta rule syntax (CVE-2018-11781)

  - A denial of service vulnerability was identified that exists in Apache SpamAssassin before 3.4.2. The     vulnerability arises with certain unclosed tags in emails that cause markup to be handled incorrectly     leading to scan timeouts. In Apache SpamAssassin, using HTML::Parser, we setup an object and hook into the     begin and end tag event handlers In both cases, the open event is immediately followed by a close     event - even if the tag *does not* close in the HTML being parsed. Because of this, we are missing the     text event to deal with the object normally. This can cause carefully crafted emails that might take     more scan time than expected leading to a Denial of Service. The issue is possibly a bug or design     decision in HTML::Parser that specifically impacts the way Apache SpamAssassin uses the module with poorly     formed html. The exploit has been seen in the wild but not believed to have been purposefully part of a     Denial of Service attempt. We are concerned that there may be attempts to abuse the vulnerability in the     future. (CVE-2017-15705)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - spamassassin: Local user code injection in the meta rule syntax (CVE-2018-11781)

  - A denial of service vulnerability was identified that exists in Apache SpamAssassin before 3.4.2. The     vulnerability arises with certain unclosed tags in emails that cause markup to be handled incorrectly     leading to scan timeouts. In Apache SpamAssassin, using HTML::Parser, we setup an object and hook into the     begin and end tag event handlers In both cases, the open event is immediately followed by a close     event - even if the tag *does not* close in the HTML being parsed. Because of this, we are missing the     text event to deal with the object normally. This can cause carefully crafted emails that might take     more scan time than expected leading to a Denial of Service. The issue is possibly a bug or design     decision in HTML::Parser that specifically impacts the way Apache SpamAssassin uses the module with poorly     formed html. The exploit has been seen in the wild but not believed to have been purposefully part of a     Denial of Service attempt. We are concerned that there may be attempts to abuse the vulnerability in the     future. (CVE-2017-15705)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

This plugin has been deprecated as it does not adhere to established standards for this style of check.

According to the versions of the spamassassin package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A denial of service vulnerability was identified that     exists in Apache SpamAssassin before 3.4.2. The     vulnerability arises with certain unclosed tags in     emails that cause markup to be handled incorrectly     leading to scan timeouts. In Apache SpamAssassin, using     HTML::Parser, we setup an object and hook into the     begin and end tag event handlers In both cases, the     'open' event is immediately followed by a 'close' event
    - even if the tag *does not* close in the HTML being     parsed. Because of this, we are missing the 'text'     event to deal with the object normally. This can cause     carefully crafted emails that might take more scan time     than expected leading to a Denial of Service. The issue     is possibly a bug or design decision in HTML::Parser     that specifically impacts the way Apache SpamAssassin     uses the module with poorly formed html. The exploit     has been seen in the wild but not believed to have been     purposefully part of a Denial of Service attempt. We     are concerned that there may be attempts to abuse the     vulnerability in the future.(CVE-2017-15705)

  - In Apache SpamAssassin before 3.4.3, a message can be     crafted in a way to use excessive resources. Upgrading     to SA 3.4.3 as soon as possible is the recommended fix     but details will not be shared     publicly.(CVE-2019-12420)

  - A command execution issue was found in Apache     SpamAssassin prior to 3.4.3. Carefully crafted     nefarious Configuration (.cf) files can be configured     to run system commands similar to CVE-2018-11805. This     issue is less stealthy and attempts to exploit the     issue will throw warnings. Thanks to Damian Lukowski at     credativ for reporting the issue ethically. With this     bug unpatched, exploits can be injected in a number of     scenarios though doing so remotely is difficult. In     addition to upgrading to SA 3.4.4, we again recommend     that users should only use update channels or 3rd party     .cf files from trusted places.(CVE-2020-1931)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the spamassassin package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A denial of service vulnerability was identified that     exists in Apache SpamAssassin before 3.4.2. The     vulnerability arises with certain unclosed tags in     emails that cause markup to be handled incorrectly     leading to scan timeouts. In Apache SpamAssassin, using     HTML::Parser, we setup an object and hook into the     begin and end tag event handlers In both cases, the     'open' event is immediately followed by a 'close' event
    - even if the tag *does not* close in the HTML being     parsed. Because of this, we are missing the 'text'     event to deal with the object normally. This can cause     carefully crafted emails that might take more scan time     than expected leading to a Denial of Service. The issue     is possibly a bug or design decision in HTML::Parser     that specifically impacts the way Apache SpamAssassin     uses the module with poorly formed html. The exploit     has been seen in the wild but not believed to have been     purposefully part of a Denial of Service attempt. We     are concerned that there may be attempts to abuse the     vulnerability in the future.(CVE-2017-15705)

  - Apache SpamAssassin 3.4.2 fixes a local user code     injection in the meta rule syntax.(CVE-2018-11781)

  - In Apache SpamAssassin before 3.4.3, a message can be     crafted in a way to use excessive resources. Upgrading     to SA 3.4.3 as soon as possible is the recommended fix     but details will not be shared     publicly.(CVE-2019-12420)

  - A command execution issue was found in Apache     SpamAssassin prior to 3.4.3. Carefully crafted     nefarious Configuration (.cf) files can be configured     to run system commands similar to CVE-2018-11805. This     issue is less stealthy and attempts to exploit the     issue will throw warnings. Thanks to Damian Lukowski at     credativ for reporting the issue ethically. With this     bug unpatched, exploits can be injected in a number of     scenarios though doing so remotely is difficult. In     addition to upgrading to SA 3.4.4, we again recommend     that users should only use update channels or 3rd party     .cf files from trusted places.(CVE-2020-1931)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for spamassassin to version 3.4.2 fixes the following issues :

Security issues fixed :

CVE-2018-11781: Fixed an issue where a local user could inject code in the meta rule syntax (bsc#1108748).

CVE-2018-11780: Fixed a potential remote code execution vulnerability in the PDFInfo plugin (bsc#1108750).

CVE-2017-15705: Fixed a denial of service through unclosed tags in crafted emails (bsc#1108745).

CVE-2016-1238: Fixed an issue where perl would load modules from the current directory (bsc#1108749).

Non-security issues fixed: Use systemd timers instead of cron (bsc#1115411)

Fixed incompatibility with Net::DNS >= 1.01 (bsc#1107765)

Fixed warning about deprecated regex during sa-update (bsc#1069831)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for spamassassin to version 3.4.2 fixes the following issues :

Security issues fixed :

  - CVE-2018-11781: Fixed an issue where a local user could     inject code in the meta rule syntax (bsc#1108748).

  - CVE-2018-11780: Fixed a potential remote code execution     vulnerability in the PDFInfo plugin (bsc#1108750).

  - CVE-2017-15705: Fixed a denial of service through     unclosed tags in crafted emails (bsc#1108745).

  - CVE-2016-1238: Fixed an issue where perl would load     modules from the current directory (bsc#1108749).

Non-security issues fixed :

  - Use systemd timers instead of cron (bsc#1115411)

  - Fixed incompatibility with Net::DNS >= 1.01     (bsc#1107765)

  - Fixed warning about deprecated regex during sa-update     (bsc#1069831)

This update was imported from the SUSE:SLE-15:Update update project.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has spamassassin packages installed that are affected by multiple vulnerabilities:

  - A flaw was found in the way a local user on the     SpamAssassin server could inject code in the meta rule     syntax. This could cause the arbitrary code execution on     the server when these rules are being processed.
    (CVE-2018-11781)

  - A flaw was found in the way SpamAssassin processes HTML     email containing unclosed HTML tags. A carefully crafted     mail message could cause SpamAssassin to consume     significant resources. If a large number of these     messages are sent, a denial of service could occur     potentially delaying or preventing the delivery of     email. (CVE-2017-15705)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for spamassassin to version 3.4.2 fixes the following issues :

Security issues fixed :

CVE-2017-15705: Fixed denial of service via unclosed tags in crafted emails (bsc#1108745).

CVE-2018-11781: Fixed a code injection in the meta rule syntax by local users (bsc#1108748).

CVE-2018-11780: Fixed a potential remote code execution vulnerability in PDFInfo plugin (bsc#1108750).

Non-security issues fixed: Added four new plugins (disabled by default): HashBL, ResourceLimits, FromNameSpoof, Phishing

sa-update script: optional support for SHA-256 / SHA-512 been added for better validation of rules

GeoIP2 support has been added to RelayCountry and URILocalBL plugins

Several new or enhanced configuration options

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Fixed some small bugs in the previous package: Initial rules now have the correct version, sought channel config is dropped (since it doesn't exist anymore) and build / runtime deps adjusted. 

----

Update to 3.4.2. Fixes CVE-2017-15705, CVE-2018-11780 and CVE-2018-11781 along with many other bugfixes and improvements. See https://www.mail-archive.com/announce@apache.org/msg04823.html for more information.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201812-07 (SpamAssassin: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in SpamAssassin. Please       review the referenced CVE identifiers for details.
  Impact :

    A remote attacker could execute arbitrary code, escalate privileges, or       cause a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

Multiple vulnerabilities were found in Spamassassin, which could lead to Remote Code Execution and Denial of Service attacks under certain circumstances.

CVE-2016-1238

Many Perl programs do not properly remove . (period) characters from the end of the includes directory array, which might allow local users to gain privileges via a Trojan horse module under the current working directory.

CVE-2017-15705

A denial of service vulnerability was identified that exists in Apache SpamAssassin before 3.4.2. The vulnerability arises with certain unclosed tags in emails that cause markup to be handled incorrectly leading to scan timeouts. This can cause carefully crafted emails that might take more scan time than expected leading to a Denial of Service.

CVE-2018-11780

A potential Remote Code Execution bug exists with the PDFInfo plugin in Apache SpamAssassin before 3.4.2.

CVE-2018-11781

Apache SpamAssassin 3.4.2 fixes a local user code injection in the meta rule syntax.

For Debian 8 'Jessie', these problems have been fixed in version 3.4.2-0+deb8u1. Upstream strongly advocates upgrading to the latest upstream version so we are following that recommendation and backported the version published as part of the 9.6 stretch release, which also fixes many critical bugs.

We recommend that you upgrade your spamassassin packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A flaw was found in the way SpamAssassin processes HTML email containing unclosed HTML tags. A carefully crafted mail message could cause SpamAssassin to consume significant resources. If a large number of these messages are sent, a denial of service could occur potentially delaying or preventing the delivery of email.(CVE-2017-15705)

A flaw was found in the way a local user on the SpamAssassin server could inject code in the meta rule syntax. This could cause the arbitrary code execution on the server when these rules are being processed.(CVE-2018-11781)

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3811-1 advisory.

    It was discovered that SpamAssassin incorrectly handled certain unclosed tags in emails. A remote attacker     could possibly use this issue to cause a denial of service. (CVE-2017-15705)

    It was discovered that SpamAssassin incorrectly handled the PDFInfo plugin. A remote attacker could     possibly use this issue to execute arbitrary code. (CVE-2018-11780)

    It was discovered that SpamAssassin incorrectly handled meta rule syntax. A local attacker could possibly     use this issue to execute arbitrary code. (CVE-2018-11781)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

A flaw was found in the way a local user on the SpamAssassin server could inject code in the meta rule syntax. This could cause the arbitrary code execution on the server when these rules are being processed.(CVE-2018-11781)

A potential Remote Code Execution bug exists with the PDFInfo plugin in Apache SpamAssassin before 3.4.2.(CVE-2018-11780)

A flaw was found in the way SpamAssassin processes HTML email containing unclosed HTML tags. A carefully crafted mail message could cause SpamAssassin to consume significant resources. If a large number of these messages are sent, a denial of service could occur potentially delaying or preventing the delivery of email.(CVE-2017-15705)

An update for spamassassin is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The SpamAssassin tool provides a way to reduce unsolicited commercial email (spam) from incoming email.

Security Fix(es) :

* spamassassin: Certain unclosed tags in crafted emails allow for scan timeouts and result in denial of service (CVE-2017-15705)

* spamassassin: Local user code injection in the meta rule syntax (CVE-2018-11781)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Security Fix(es) :

  - spamassassin: Certain unclosed tags in crafted emails     allow for scan timeouts and result in denial of service     (CVE-2017-15705)

  - spamassassin: Local user code injection in the meta rule     syntax (CVE-2018-11781)

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2018:2916 advisory.

    The SpamAssassin tool provides a way to reduce unsolicited commercial email (spam) from incoming email.

    Security Fix(es):

    * spamassassin: Certain unclosed tags in crafted emails allow for scan timeouts and result in denial of     service (CVE-2017-15705)

    * spamassassin: Local user code injection in the meta rule syntax (CVE-2018-11781)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2018-2916 advisory.

    - Fix CVE-2018-11781 - Local user code injection in the meta rule syntax
    - Fix CVE-2017-15705 - Certain unclosed tags in crafted emails allow for

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

the Apache Spamassassin project reports :

In Apache SpamAssassin, using HTML::Parser, we setup an object and hook into the begin and end tag event handlers In both cases, the 'open' event is immediately followed by a 'close' event - even if the tag *does not* close in the HTML being parsed.

Because of this, we are missing the 'text' event to deal with the object normally. This can cause carefully crafted emails that might take more scan time than expected leading to a Denial of Service.

Fix a reliance on '.' in @INC in one configuration script. Whether this can be exploited in any way is uncertain.

Fix a potential Remote Code Execution bug with the PDFInfo plugin.
Thanks to cPanel Security Team for their report of this issue.

Fourth, this release fixes a local user code injection in the meta rule syntax. Thanks again to cPanel Security Team for their report of this issue.

ID	Name	Product	Family	Severity
199079	RHEL 6 : spamassassin (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
199045	RHEL 5 : spamassassin (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
196386	RHEL 5 : spamassassin (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	high
196385	RHEL 6 : spamassassin (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	critical
146670	EulerOS 2.0 SP2 : spamassassin (EulerOS-SA-2021-1360)	Nessus	Huawei Local Security Checks	high
142129	EulerOS 2.0 SP5 : spamassassin (EulerOS-SA-2020-2272)	Nessus	Huawei Local Security Checks	high
127751	SUSE SLED15 / SLES15 Security Update : spamassassin (SUSE-SU-2019:2011-1)	Nessus	SuSE Local Security Checks	critical
127739	openSUSE Security Update : spamassassin (openSUSE-2019-1831)	Nessus	SuSE Local Security Checks	critical
127217	NewStart CGSL CORE 5.04 / MAIN 5.04 : spamassassin Multiple Vulnerabilities (NS-SA-2019-0041)	Nessus	NewStart CGSL Local Security Checks	high
127038	SUSE SLED12 / SLES12 Security Update : spamassassin (SUSE-SU-2019:1961-1)	Nessus	SuSE Local Security Checks	critical
120609	Fedora 29 : spamassassin (2018-8f0df2c366)	Nessus	Fedora Local Security Checks	critical
120387	Fedora 28 : spamassassin (2018-46d7a7f63e)	Nessus	Fedora Local Security Checks	critical
119703	GLSA-201812-07 : SpamAssassin: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
118938	Debian DLA-1578-1 : spamassassin security update	Nessus	Debian Local Security Checks	critical
118834	Amazon Linux 2 : spamassassin (ALAS-2018-1103)	Nessus	Amazon Linux Local Security Checks	high
118797	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : SpamAssassin vulnerabilities (USN-3811-1)	Nessus	Ubuntu Local Security Checks	critical
118211	Amazon Linux AMI : spamassassin (ALAS-2018-1091)	Nessus	Amazon Linux Local Security Checks	critical
118117	CentOS 7 : spamassassin (CESA-2018:2916)	Nessus	CentOS Local Security Checks	high
118108	Scientific Linux Security Update : spamassassin on SL7.x x86_64 (20181011)	Nessus	Scientific Linux Local Security Checks	high
118077	RHEL 7 : spamassassin (RHSA-2018:2916)	Nessus	Red Hat Local Security Checks	high
118076	Oracle Linux 7 : spamassassin (ELSA-2018-2916)	Nessus	Oracle Linux Local Security Checks	high
117840	Fedora 27 : spamassassin (2018-6ed251c42b)	Nessus	Fedora Local Security Checks	critical
117721	FreeBSD : spamassassin -- multiple vulnerabilities (613193a0-c1b4-11e8-ae2d-54e1ad3d6335)	Nessus	FreeBSD Local Security Checks	critical

Detections

Analytics

CVE-2017-15705

medium

Tenable Plugins

high

high

high

critical

high

high

critical

critical

high

critical

critical

critical

critical

critical

high

critical

critical

high

high

high

high

critical

critical