A potential Remote Code Execution bug exists with the PDFInfo plugin in Apache SpamAssassin before 3.4.2.

This update for spamassassin to version 3.4.2 fixes the following issues :

Security issues fixed :

CVE-2018-11781: Fixed an issue where a local user could inject code in the meta rule syntax (bsc#1108748).

CVE-2018-11780: Fixed a potential remote code execution vulnerability in the PDFInfo plugin (bsc#1108750).

CVE-2017-15705: Fixed a denial of service through unclosed tags in crafted emails (bsc#1108745).

CVE-2016-1238: Fixed an issue where perl would load modules from the current directory (bsc#1108749).

Non-security issues fixed: Use systemd timers instead of cron (bsc#1115411)

Fixed incompatibility with Net::DNS >= 1.01 (bsc#1107765)

Fixed warning about deprecated regex during sa-update (bsc#1069831)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for spamassassin to version 3.4.2 fixes the following issues :

Security issues fixed :

  - CVE-2018-11781: Fixed an issue where a local user could     inject code in the meta rule syntax (bsc#1108748).

  - CVE-2018-11780: Fixed a potential remote code execution     vulnerability in the PDFInfo plugin (bsc#1108750).

  - CVE-2017-15705: Fixed a denial of service through     unclosed tags in crafted emails (bsc#1108745).

  - CVE-2016-1238: Fixed an issue where perl would load     modules from the current directory (bsc#1108749).

Non-security issues fixed :

  - Use systemd timers instead of cron (bsc#1115411)

  - Fixed incompatibility with Net::DNS >= 1.01     (bsc#1107765)

  - Fixed warning about deprecated regex during sa-update     (bsc#1069831)

This update was imported from the SUSE:SLE-15:Update update project.

This update for spamassassin to version 3.4.2 fixes the following issues :

Security issues fixed :

CVE-2017-15705: Fixed denial of service via unclosed tags in crafted emails (bsc#1108745).

CVE-2018-11781: Fixed a code injection in the meta rule syntax by local users (bsc#1108748).

CVE-2018-11780: Fixed a potential remote code execution vulnerability in PDFInfo plugin (bsc#1108750).

Non-security issues fixed: Added four new plugins (disabled by default): HashBL, ResourceLimits, FromNameSpoof, Phishing

sa-update script: optional support for SHA-256 / SHA-512 been added for better validation of rules

GeoIP2 support has been added to RelayCountry and URILocalBL plugins

Several new or enhanced configuration options

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Fixed some small bugs in the previous package: Initial rules now have the correct version, sought channel config is dropped (since it doesn't exist anymore) and build / runtime deps adjusted. 

----

Update to 3.4.2. Fixes CVE-2017-15705, CVE-2018-11780 and CVE-2018-11781 along with many other bugfixes and improvements. See https://www.mail-archive.com/announce@apache.org/msg04823.html for more information.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201812-07 (SpamAssassin: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in SpamAssassin. Please       review the referenced CVE identifiers for details.
  Impact :

    A remote attacker could execute arbitrary code, escalate privileges, or       cause a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

Multiple vulnerabilities were found in Spamassassin, which could lead to Remote Code Execution and Denial of Service attacks under certain circumstances.

CVE-2016-1238

Many Perl programs do not properly remove . (period) characters from the end of the includes directory array, which might allow local users to gain privileges via a Trojan horse module under the current working directory.

CVE-2017-15705

A denial of service vulnerability was identified that exists in Apache SpamAssassin before 3.4.2. The vulnerability arises with certain unclosed tags in emails that cause markup to be handled incorrectly leading to scan timeouts. This can cause carefully crafted emails that might take more scan time than expected leading to a Denial of Service.

CVE-2018-11780

A potential Remote Code Execution bug exists with the PDFInfo plugin in Apache SpamAssassin before 3.4.2.

CVE-2018-11781

Apache SpamAssassin 3.4.2 fixes a local user code injection in the meta rule syntax.

For Debian 8 'Jessie', these problems have been fixed in version 3.4.2-0+deb8u1. Upstream strongly advocates upgrading to the latest upstream version so we are following that recommendation and backported the version published as part of the 9.6 stretch release, which also fixes many critical bugs.

We recommend that you upgrade your spamassassin packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3811-1 advisory.

    It was discovered that SpamAssassin incorrectly handled certain unclosed tags in emails. A remote attacker     could possibly use this issue to cause a denial of service. (CVE-2017-15705)

    It was discovered that SpamAssassin incorrectly handled the PDFInfo plugin. A remote attacker could     possibly use this issue to execute arbitrary code. (CVE-2018-11780)

    It was discovered that SpamAssassin incorrectly handled meta rule syntax. A local attacker could possibly     use this issue to execute arbitrary code. (CVE-2018-11781)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

A flaw was found in the way a local user on the SpamAssassin server could inject code in the meta rule syntax. This could cause the arbitrary code execution on the server when these rules are being processed.(CVE-2018-11781)

A potential Remote Code Execution bug exists with the PDFInfo plugin in Apache SpamAssassin before 3.4.2.(CVE-2018-11780)

A flaw was found in the way SpamAssassin processes HTML email containing unclosed HTML tags. A carefully crafted mail message could cause SpamAssassin to consume significant resources. If a large number of these messages are sent, a denial of service could occur potentially delaying or preventing the delivery of email.(CVE-2017-15705)

the Apache Spamassassin project reports :

In Apache SpamAssassin, using HTML::Parser, we setup an object and hook into the begin and end tag event handlers In both cases, the 'open' event is immediately followed by a 'close' event - even if the tag *does not* close in the HTML being parsed.

Because of this, we are missing the 'text' event to deal with the object normally. This can cause carefully crafted emails that might take more scan time than expected leading to a Denial of Service.

Fix a reliance on '.' in @INC in one configuration script. Whether this can be exploited in any way is uncertain.

Fix a potential Remote Code Execution bug with the PDFInfo plugin.
Thanks to cPanel Security Team for their report of this issue.

Fourth, this release fixes a local user code injection in the meta rule syntax. Thanks again to cPanel Security Team for their report of this issue.

ID	Name	Product	Family	Severity
127751	SUSE SLED15 / SLES15 Security Update : spamassassin (SUSE-SU-2019:2011-1)	Nessus	SuSE Local Security Checks	critical
127739	openSUSE Security Update : spamassassin (openSUSE-2019-1831)	Nessus	SuSE Local Security Checks	critical
127038	SUSE SLED12 / SLES12 Security Update : spamassassin (SUSE-SU-2019:1961-1)	Nessus	SuSE Local Security Checks	critical
120609	Fedora 29 : spamassassin (2018-8f0df2c366)	Nessus	Fedora Local Security Checks	critical
120387	Fedora 28 : spamassassin (2018-46d7a7f63e)	Nessus	Fedora Local Security Checks	critical
119703	GLSA-201812-07 : SpamAssassin: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
118938	Debian DLA-1578-1 : spamassassin security update	Nessus	Debian Local Security Checks	critical
118797	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : SpamAssassin vulnerabilities (USN-3811-1)	Nessus	Ubuntu Local Security Checks	critical
118211	Amazon Linux AMI : spamassassin (ALAS-2018-1091)	Nessus	Amazon Linux Local Security Checks	critical
117840	Fedora 27 : spamassassin (2018-6ed251c42b)	Nessus	Fedora Local Security Checks	critical
117721	FreeBSD : spamassassin -- multiple vulnerabilities (613193a0-c1b4-11e8-ae2d-54e1ad3d6335)	Nessus	FreeBSD Local Security Checks	critical

Detections

Analytics

CVE-2018-11780

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical