smtpd/lka_filter.c in OpenSMTPD before 6.8.0p1, in certain configurations, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted pattern of client activity, because the filter state machine does not properly maintain the I/O channel between the SMTP engine and the filters layer.

The remote host is affected by the vulnerability described in GLSA-202105-12 (OpenSMTPD: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in OpenSMTPD. Please       review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker, by connecting to the SMTP listener daemon, could       possibly cause a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

The remote Fedora 32 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2021-71fbdecdf8 advisory.

  - smtpd/table.c in OpenSMTPD before 6.8.0p1 lacks a certain regfree, which might allow attackers to trigger     a very significant memory leak via messages to an instance that performs many regex lookups.
    (CVE-2020-35679)

  - smtpd/lka_filter.c in OpenSMTPD before 6.8.0p1, in certain configurations, allows remote attackers to     cause a denial of service (NULL pointer dereference and daemon crash) via a crafted pattern of client     activity, because the filter state machine does not properly maintain the I/O channel between the SMTP     engine and the filters layer. (CVE-2020-35680)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 33 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2021-848fd34b0b advisory.

  - smtpd/table.c in OpenSMTPD before 6.8.0p1 lacks a certain regfree, which might allow attackers to trigger     a very significant memory leak via messages to an instance that performs many regex lookups.
    (CVE-2020-35679)

  - smtpd/lka_filter.c in OpenSMTPD before 6.8.0p1, in certain configurations, allows remote attackers to     cause a denial of service (NULL pointer dereference and daemon crash) via a crafted pattern of client     activity, because the filter state machine does not properly maintain the I/O channel between the SMTP     engine and the filters layer. (CVE-2020-35680)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
150009	GLSA-202105-12 : OpenSMTPD: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
145780	Fedora 32 : opensmtpd (2021-71fbdecdf8)	Nessus	Fedora Local Security Checks	high
145747	Fedora 33 : opensmtpd (2021-848fd34b0b)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2020-35680

high

Tenable Plugins

high

high

high