OpenDMARC through 1.3.2 and 1.4.x through 1.4.0-Beta1 has improper null termination in the function opendmarc_xml_parse that can result in a one-byte heap overflow in opendmarc_xml when parsing a specially crafted DMARC aggregate report. This can cause remote memory corruption when a '\0' byte overwrites the heap metadata of the next chunk and its PREV_INUSE flag.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 937aa1d6-685e-11ec-a636-000c29061ce6 advisory.

  - OpenDMARC through 1.3.2 and 1.4.x through 1.4.0-Beta1 is prone to a signature-bypass vulnerability with     multiple From: addresses, which might affect applications that consider a domain name to be relevant to     the origin of an e-mail message. (CVE-2019-16378)

  - OpenDMARC through 1.3.2 and 1.4.x, when used with pypolicyd-spf 2.0.2, allows attacks that bypass SPF and     DMARC authentication in situations where the HELO field is inconsistent with the MAIL FROM field.
    (CVE-2019-20790)

  - OpenDMARC through 1.3.2 and 1.4.x allows attacks that inject authentication results to provide false     information about the domain that originated an e-mail message. This is caused by incorrect parsing and     interpretation of SPF/DKIM authentication results, as demonstrated by the example.net(.example.com     substring. (CVE-2020-12272)

  - OpenDMARC through 1.3.2 and 1.4.x through 1.4.0-Beta1 has improper null termination in the function     opendmarc_xml_parse that can result in a one-byte heap overflow in opendmarc_xml when parsing a specially     crafted DMARC aggregate report. This can cause remote memory corruption when a '\0' byte overwrites the     heap metadata of the next chunk and its PREV_INUSE flag. (CVE-2020-12460)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 ESM / 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6356-1 advisory.

    Jianjun Chen, Vern Paxson and Jian Jiang discovered that OpenDMARC incorrectly handled certain inputs. If     a user or an automated system were tricked into receiving crafted inputs, an attacker could possibly use     this to falsify the domain of an e-mails origin. (CVE-2020-12272)

    Patrik Lantz discovered that OpenDMARC incorrectly handled certain inputs. If a user or an automated     system were tricked into opening a specially crafted input file, a remote attacker could possibly use this     issue to cause a denial of service. (CVE-2020-12460)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It was discovered that OpenDMARC, a milter implementation of DMARC, has improper null termination in the function opendmarc_xml_parse that can result in a one-byte heap overflow in opendmarc_xml when parsing a specially crafted DMARC aggregate report. This can cause remote memory corruption when a '\0' byte overwrites the heap metadata of the next chunk and its PREV_INUSE flag.

For Debian 9 stretch, this problem has been fixed in version 1.3.2-2+deb9u3.

We recommend that you upgrade your opendmarc packages.

For the detailed security status of opendmarc please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/opendmarc

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-202011-02 (OpenDMARC: Heap-based buffer overflow)

    It was found that OpenDMARC did not properly handle DMARC aggregate       reports.
  Impact :

    A remote attacker, by sending a specially crafted DMARC aggregate       report, could possibly cause a Denial of Service condition and depending       on how OpenDMARC library is used in linked application execute arbitrary       code with the privileges of the process.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Severity
184467	FreeBSD : OpenDMARC - Multiple vulnerabilities (937aa1d6-685e-11ec-a636-000c29061ce6)	Nessus	FreeBSD Local Security Checks	critical
181238	Ubuntu 16.04 ESM / 18.04 LTS / 20.04 LTS : OpenDMARC vulnerabilities (USN-6356-1)	Nessus	Ubuntu Local Security Checks	critical
149014	Debian DLA-2639-1 : opendmarc security update	Nessus	Debian Local Security Checks	critical
142250	GLSA-202011-02 : OpenDMARC: Heap-based buffer overflow	Nessus	Gentoo Local Security Checks	critical

Detections

Analytics

CVE-2020-12460

critical

Tenable Plugins

critical

critical

critical

critical