FreeBSD : spamassassin -- Apache SpamAssassin Nefarious rule configuration (.cf) files can be configured to run system commands with warnings (e3404a6e-4364-11ea-b643-206a8a720317)

high Nessus Plugin ID 133380

Language:

Synopsis

The remote FreeBSD host is missing a security-related update.

Description

the Apache Spamassassin project reports :

nefarious rule configuration (.cf) files can be configured to run system commands similar to CVE-2018-11805. This issue is less stealthy and attempts to exploit the issue will throw warnings.

Solution

Update the affected package.

Plugin Details

Severity: High

ID: 133380

File Name: freebsd_pkg_e3404a6e436411eab643206a8a720317.nasl

Version: 1.5

Type: local

Family: FreeBSD Local Security Checks

Published: 1/31/2020

Updated: 6/3/2021

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 5.9

CVSS v2

Risk Factor: High

Base Score: 9.3

Temporal Score: 6.9

Vector: CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2020-1931

CVSS v3

Risk Factor: High

Base Score: 8.1

Temporal Score: 7.1

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/o:freebsd:freebsd, p-cpe:/a:freebsd:freebsd:spamassassin

Required KB Items: Host/local_checks_enabled, Host/FreeBSD/release, Host/FreeBSD/pkg_info

Exploit Ease: No known exploits are available

Patch Publication Date: 1/30/2020

Vulnerability Publication Date: 1/30/2020

Reference Information

CVE: CVE-2020-1931

IAVA: 2020-A-0056-S

Detections

Analytics