Detections
Analytics

Debian DSA-736-1 : spamassassin - remote denial of service

medium Nessus Plugin ID 18596

Synopsis

The remote Debian host is missing a security-related update.

Description

A vulnerability was recently found in the way that SpamAssassin parses certain email headers. This vulnerability could cause SpamAssassin to consume a large number of CPU cycles when processing messages containing these headers, leading to a potential denial of service (DOS) attack.

The version of SpamAssassin in the old stable distribution (woody) is not vulnerable.

Solution

Upgrade the sarge or sid spamassassin package.

For the stable distribution (sarge), this problem has been fixed in version 3.0.3-2. Note that packages are not yet ready for certain architectures; these will be released as they become available.

See Also

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=314447

http://www.debian.org/security/2005/dsa-736

Plugin Details

Severity: Medium

ID: 18596

File Name: debian_DSA-736.nasl

Version: 1.18

Type: local

Agent: unix

Published: 7/1/2005

Updated: 1/4/2021

Supported Sensors: Agentless Assessment, Continuous Assessment, Frictionless Assessment Agent, Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Low

Score: 3.6

CVSS v2

Risk Factor: Medium

Base Score: 5

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P

Vulnerability Information

CPE: cpe:/o:debian:debian_linux:3.1, p-cpe:/a:debian:debian_linux:spamassassin

Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l

Patch Publication Date: 7/1/2005

Vulnerability Publication Date: 6/6/2005

Reference Information

CVE: CVE-2005-1266

DSA: 736