OpenSMTPD before 6.6.4 allows remote code execution because of an out-of-bounds read in mta_io in mta_session.c for multi-line replies. Although this vulnerability affects the client side of OpenSMTPD, it is possible to attack a server because the server code launches the client code during bounce handling.

The remote Ubuntu 16.04 ESM host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4875-1 advisory.

    It was discovered that OpenSMTPD incorrectly verified the sender's or receiver's e-mail addresses under     certain conditions. An attacker could possibly use this vulnerability to execute arbitrary commands as     root. (CVE-2020-7247)

    It was discovered that OpenSMTPD did not properly handle hardlinks under certain conditions. An     unprivileged local attacker could possibly use this issue to obtain sensitive information. This issue only     affected Ubuntu 16.04 ESM. (CVE-2020-8793)

    It was discovered that OpenSMTPD mishandled certain input. A remote, unauthenticated attacker could     possibly use this vulnerability to execute arbitrary shell commands as any non-root user. This issue only     affected Ubuntu 16.04 ESM. (CVE-2020-8794)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4294-1 advisory.

    It was discovered that OpenSMTPD mishandled certain input. A remote, unauthenticated attacker could use     this vulnerability to execute arbitrary shell commands as any non-root user. (CVE-2020-8794)

    It was discovered that OpenSMTPD did not properly handle hardlinks under certain conditions. An     unprivileged local attacker could read the first line of any file on the filesystem. (CVE-2020-8793)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Qualys discovered that the OpenSMTPD SMTP server performed insufficient validation of SMTP commands, which could result in local privilege escalation or the execution of arbitrary code.

OpenSMTPD developers reports :

An out of bounds read in smtpd allows an attacker to inject arbitrary commands into the envelope file which are then executed as root.
Separately, missing privilege revocation in smtpctl allows arbitrary commands to be run with the _smtpq group.

An unprivileged local attacker can read the first line of an arbitrary file (for example, root's password hash in /etc/master.passwd) or the entire contents of another user's file (if this file and /var/spool/smtpd/ are on the same filesystem).

ID	Name	Product	Family	Severity
183572	Ubuntu 16.04 ESM : OpenSMTPD vulnerabilities (USN-4875-1)	Nessus	Ubuntu Local Security Checks	critical
134299	Ubuntu 18.04 LTS : OpenSMTPD vulnerabilities (USN-4294-1)	Nessus	Ubuntu Local Security Checks	critical
134094	Debian DSA-4634-1 : opensmtpd - security update	Nessus	Debian Local Security Checks	critical
133973	FreeBSD : OpenSMTPd -- LPE and RCE in OpenSMTPD's default install (f0683976-5779-11ea-8a77-1c872ccb1e42)	Nessus	FreeBSD Local Security Checks	critical
133970	FreeBSD : OpenSMTPd -- LPE and RCE in OpenSMTPD's default install (40c75597-574a-11ea-bff8-c85b76ce9b5a)	Nessus	FreeBSD Local Security Checks	critical

Detections

Analytics

CVE-2020-8794

critical

Tenable Plugins

critical

critical

critical

critical

critical