SpamAssassin Malformed Email Remote Denial Of Service Vulnerability

BID:10957

Info

SpamAssassin Malformed Email Remote Denial Of Service Vulnerability

Bugtraq ID: 10957
Class: Access Validation Error
CVE: CVE-2004-0796
Remote: Yes
Local: No
Published: Aug 16 2004 12:00AM
Updated: Jul 12 2009 06:16AM
Credit: This vulnerability was announced by the vendor.
Vulnerable: SpamAssassin SpamAssassin 2.63
SpamAssassin SpamAssassin 2.60
SpamAssassin SpamAssassin 2.55
SpamAssassin SpamAssassin 2.50 0
SpamAssassin SpamAssassin 2.44
SpamAssassin SpamAssassin 2.43 0
+ Gentoo Linux 1.4 _rc2
 + Gentoo Linux 1.4 _rc1
 SpamAssassin SpamAssassin 2.42 0
SpamAssassin SpamAssassin 2.41 0
SpamAssassin SpamAssassin 2.40
Redhat Fedora Core1
Not Vulnerable: SpamAssassin SpamAssassin 2.64

Discussion

SpamAssassin Malformed Email Remote Denial Of Service Vulnerability

SpamAssassin is reported prone to a remote denial of service vulnerability. Full details regarding this vulnerability are not known.

A remote attacker may potentially exploit this vulnerability to deny service to a target SpamAssassin service.

SpamAssassin versions prior to 2.64 are reported vulnerable to this issue.

This BID will be updated as further details regarding this vulnerability are announced.

Exploit / POC

SpamAssassin Malformed Email Remote Denial Of Service Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Solution / Fix

SpamAssassin Malformed Email Remote Denial Of Service Vulnerability

Solution:
The vendor has released version 2.64 addressing this issue.

Gentoo Linux has released advisory GLSA 200408-06 addressing this issue. Please see the referenced advisory for further information. Users of affected packages are urged to execute the following commands with superuser privileges:
emerge sync
emerge -pv ">=mail-filter/spamassassin-2.64"
emerge ">=mail-filter/spamassassin-2.64"

Mandrake has released advisory MDKSA-2004:084 to address this issue. Please see the attached advisory for details on obtaining and applying fixes.

OpenBSD has fixed this issue in OpenBSD-current, and the patch branches of 3.4 and 3.5. CVS as of 8 Aug 2004 has these fixes.

OpenPKG has released an advisory (OpenPKG-SA-2004.041) to address this issue. Please see the referenced advisory for more information.

Conectiva has released an advisory (CLA-2004:867) to address this issue. Please see the referenced advisory for more information.

Red Hat has released an advisory (RHSA-2004:451-05) to address this issue in Red Hat Enterprise Linux. Please see the advisory in Web references for more information.

A Fedora Legacy advisory FLSA:2268 is available to address this issue in Fedora Core 1 for the i386 architecture. Please see the referenced advisory for more information.


SpamAssassin SpamAssassin 2.40

SpamAssassin SpamAssassin 2.41 0

SpamAssassin SpamAssassin 2.42 0

SpamAssassin SpamAssassin 2.43 0

SpamAssassin SpamAssassin 2.44

SpamAssassin SpamAssassin 2.50 0

SpamAssassin SpamAssassin 2.55

SpamAssassin SpamAssassin 2.60

SpamAssassin SpamAssassin 2.63

References

SpamAssassin Malformed Email Remote Denial Of Service Vulnerability

References:

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report