SpamAssassin Malformed Email Header Remote Denial Of Service Vulnerability

Bugtraq ID:	13978
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2005-1266
Remote:	Yes
Local:	No
Published:	Jun 17 2005 12:00AM
Updated:	Mar 12 2007 07:14PM
Credit:	This vulnerability was announced by the vendor.
Vulnerable:	SpamAssassin SpamAssassin 3.0.3 + Debian Linux 3.1 sparc + Debian Linux 3.1 s/390 + Debian Linux 3.1 ppc + Debian Linux 3.1 mipsel + Debian Linux 3.1 mips + Debian Linux 3.1 m68k + Debian Linux 3.1 ia-64 + Debian Linux 3.1 ia-32 + Debian Linux 3.1 hppa + Debian Linux 3.1 arm + Debian Linux 3.1 amd64 + Debian Linux 3.1 alpha + Debian Linux 3.1 SpamAssassin SpamAssassin 3.0.2 SpamAssassin SpamAssassin 3.0.1 SpamAssassin SpamAssassin 2.63 SpamAssassin SpamAssassin 2.60 SpamAssassin SpamAssassin 2.55 SpamAssassin SpamAssassin 2.50 0 SpamAssassin SpamAssassin 2.44 SpamAssassin SpamAssassin 2.43 0 + Gentoo Linux 1.4 _rc2 + Gentoo Linux 1.4 _rc1 SpamAssassin SpamAssassin 2.42 0 SpamAssassin SpamAssassin 2.41 0 SpamAssassin SpamAssassin 2.40 S.u.S.E. Linux Professional 9.3 x86_64 S.u.S.E. Linux Professional 9.3 S.u.S.E. Linux Professional 9.2 x86_64 S.u.S.E. Linux Professional 9.2 S.u.S.E. Linux Personal 9.3 x86_64 S.u.S.E. Linux Personal 9.3 S.u.S.E. Linux Personal 9.2 x86_64 S.u.S.E. Linux Personal 9.2 Redhat Fedora Core4 Redhat Fedora Core3 Redhat Fedora Core1 Redhat Enterprise Linux WS 4 Redhat Enterprise Linux ES 4 Redhat Enterprise Linux AS 4 Redhat Desktop 4.0 Mandriva Linux Mandrake 10.2 x86_64 Mandriva Linux Mandrake 10.2 Mandriva Linux Mandrake 10.1 x86_64 Mandriva Linux Mandrake 10.1 Gentoo Linux
Not Vulnerable:	SpamAssassin SpamAssassin 3.0.4 SpamAssassin SpamAssassin 2.64

SpamAssassin Malformed Email Header Remote Denial Of Service Vulnerability

SpamAssassin is prone to a remote denial-of-service vulnerability because the application fails to properly handle overly long email headers.

Further details regarding this vulnerability are currently not available. This BID will be updated as more information is disclosed.

An attacker may cause SpamAssassin to take inordinate amounts of time to check a specially crafted email message. By sending many malicious messages, the attacker may be able to cause extremely large delays in email delivery, denying service to legitimate users.

SpamAssassin Malformed Email Header Remote Denial Of Service Vulnerability

An exploit is not required.

SpamAssassin Malformed Email Header Remote Denial Of Service Vulnerability

Solution:
The vendor has released version 3.0.4 addressing this issue.


SpamAssassin SpamAssassin 2.40

• SpamAssassin Mail-SpamAssassin-2.64.tar.gz
  http://old.spamassassin.org/released/Mail-SpamAssassin-2.64.tar.gz

SpamAssassin SpamAssassin 2.41 0

• SpamAssassin Mail-SpamAssassin-2.64.tar.gz
  http://old.spamassassin.org/released/Mail-SpamAssassin-2.64.tar.gz

SpamAssassin SpamAssassin 2.42 0

• SpamAssassin Mail-SpamAssassin-2.64.tar.gz
  http://old.spamassassin.org/released/Mail-SpamAssassin-2.64.tar.gz

SpamAssassin SpamAssassin 2.43 0

• SpamAssassin Mail-SpamAssassin-2.64.tar.gz
  http://old.spamassassin.org/released/Mail-SpamAssassin-2.64.tar.gz

SpamAssassin SpamAssassin 2.44

• Mandrake perl-Mail-SpamAssassin-2.44-1.1.91mdk.i586.rpm
  Mandrake Linux 9.1
  http://www.mandrakesecure.net/en/ftp.php


• Mandrake perl-Mail-SpamAssassin-2.44-1.1.91mdk.ppc.rpm
  Mandrake Linux 9.1/PPC
  http://www.mandrakesecure.net/en/ftp.php


• Mandrake perl-Mail-SpamAssassin-2.53-1.1.C21mdk.x86_64.rpm
  Mandrake Corporate Server 2.1/X86_64
  http://www.mandrakesecure.net/en/ftp.php


• Mandrake spamassassin-2.44-1.1.91mdk.i586.rpm
  Mandrake Linux 9.1
  http://www.mandrakesecure.net/en/ftp.php


• Mandrake spamassassin-2.44-1.1.91mdk.ppc.rpm
  Mandrake Linux 9.1/PPC
  http://www.mandrakesecure.net/en/ftp.php


• Mandrake spamassassin-2.53-1.1.C21mdk.x86_64.rpm
  Mandrake Corporate Server 2.1/X86_64
  http://www.mandrakesecure.net/en/ftp.php


• Mandrake spamassassin-tools-2.44-1.1.91mdk.i586.rpm
  Mandrake Linux 9.1
  http://www.mandrakesecure.net/en/ftp.php


• Mandrake spamassassin-tools-2.44-1.1.91mdk.ppc.rpm
  Mandrake Linux 9.1/PPC
  http://www.mandrakesecure.net/en/ftp.php


• Mandrake spamassassin-tools-2.53-1.1.C21mdk.x86_64.rpm
  Mandrake Corporate Server 2.1/X86_64
  http://www.mandrakesecure.net/en/ftp.php


• SpamAssassin Mail-SpamAssassin-2.64.tar.gz
  http://old.spamassassin.org/released/Mail-SpamAssassin-2.64.tar.gz

SpamAssassin SpamAssassin 2.50 0

• SpamAssassin Mail-SpamAssassin-2.64.tar.gz
  http://old.spamassassin.org/released/Mail-SpamAssassin-2.64.tar.gz

SpamAssassin SpamAssassin 2.55

• Mandrake perl-Mail-SpamAssassin-2.55-2.1.92mdk.amd64.rpm
  Mandrake Linux 9.2/AMD64
  http://www.mandrakesecure.net/en/ftp.php


• Mandrake perl-Mail-SpamAssassin-2.55-2.1.92mdk.i586.rpm
  Mandrake Linux 9.2
  http://www.mandrakesecure.net/en/ftp.php


• Mandrake spamassassin-2.55-2.1.92mdk.amd64.rpm
  Mandrake Linux 9.2/AMD64
  http://www.mandrakesecure.net/en/ftp.php


• Mandrake spamassassin-2.55-2.1.92mdk.i586.rpm
  Mandrake Linux 9.2
  http://www.mandrakesecure.net/en/ftp.php


• Mandrake spamassassin-tools-2.55-2.1.92mdk.amd64.rpm
  Mandrake Linux 9.2/AMD64
  http://www.mandrakesecure.net/en/ftp.php


• Mandrake spamassassin-tools-2.55-2.1.92mdk.i586.rpm
  Mandrake Linux 9.2
  http://www.mandrakesecure.net/en/ftp.php

SpamAssassin SpamAssassin 2.60

• Conectiva spamassassin-2.60-28724U90_2cl.i386.rpm
  ftp://atualizacoes.conectiva.com.br/9/RPMS/spamassassin-2.60-28724U90_ 2cl.i386.rpm


• Conectiva spamassassin-doc-2.60-28724U90_2cl.i386.rpm
  ftp://atualizacoes.conectiva.com.br/9/RPMS/spamassassin-doc-2.60-28724 U90_2cl.i386.rpm


• RedHat spamassassin-2.63-0.2.2.legacy.i386.rpm
  RedHat Fedora Core 1
  http://download.fedoralegacy.org/fedora/1/updates/i386/spamassassin-2. 63-0.2.2.legacy.i386.rpm


• SpamAssassin Mail-SpamAssassin-2.64.tar.gz
  http://old.spamassassin.org/released/Mail-SpamAssassin-2.64.tar.gz

SpamAssassin SpamAssassin 2.63

• Conectiva spamassassin-2.63-54029U10_2cl.i386.rpm
  ftp://atualizacoes.conectiva.com.br/10/RPMS/spamassassin-2.63-54029U10 _2cl.i386.rpm


• Conectiva spamassassin-doc-2.63-54029U10_2cl.i386.rpm
  ftp://atualizacoes.conectiva.com.br/10/RPMS/spamassassin-doc-2.63-5402 9U10_2cl.i386.rpm


• Mandrake perl-Mail-SpamAssassin-2.63-2.1.100mdk.amd64.rpm
  Mandrake Linux 10.0/AMD64
  http://www.mandrakesecure.net/en/ftp.php


• Mandrake perl-Mail-SpamAssassin-2.63-2.1.100mdk.i586.rpm
  Mandrake Linux 10.0
  http://www.mandrakesecure.net/en/ftp.php


• Mandrake spamassassin-2.63-2.1.100mdk.amd64.rpm
  Mandrake Linux 10.0/AMD64
  http://www.mandrakesecure.net/en/ftp.php


• Mandrake spamassassin-2.63-2.1.100mdk.i586.rpm
  Mandrake Linux 10.0
  http://www.mandrakesecure.net/en/ftp.php


• Mandrake spamassassin-tools-2.63-2.1.100mdk.amd64.rpm
  Mandrake Linux 10.0/AMD64
  http://www.mandrakesecure.net/en/ftp.php


• Mandrake spamassassin-tools-2.63-2.1.100mdk.i586.rpm
  Mandrake Linux 10.0
  http://www.mandrakesecure.net/en/ftp.php


• OpenPKG spamassassin-2.63-2.0.1.src.rpm
  ftp://ftp.openpkg.org/release/2.0/UPD/spamassassin-2.63-2.0.1.src.rpm

SpamAssassin SpamAssassin 3.0.1

• Fedora spamassassin-3.0.4-1.fc3.i386.rpm
  RedHat Fedora Core 3
  http://download.fedora.redhat.com/pub/fedora/linux/core/updates/3/


• Fedora spamassassin-3.0.4-1.fc3.x86_64.rpm
  RedHat Fedora Core 3
  http://download.fedora.redhat.com/pub/fedora/linux/core/updates/3/


• Fedora spamassassin-debuginfo-3.0.4-1.fc3.i386.rpm
  RedHat Fedora Core 3
  http://download.fedora.redhat.com/pub/fedora/linux/core/updates/3/


• Fedora spamassassin-debuginfo-3.0.4-1.fc3.x86_64.rpm
  RedHat Fedora Core 3
  http://download.fedora.redhat.com/pub/fedora/linux/core/updates/3/


• SpamAssassin Mail-SpamAssassin-3.0.4.tar.gz
  http://apache.mirror.cygnal.ca/spamassassin/source/Mail-SpamAssassin-3 .0.4.tar.gz

SpamAssassin SpamAssassin 3.0.2

• SpamAssassin Mail-SpamAssassin-3.0.4.tar.gz
  http://apache.mirror.cygnal.ca/spamassassin/source/Mail-SpamAssassin-3 .0.4.tar.gz


• SuSE perl-spamassassin-3.0.4-1.1.i586.rpm
  SUSE Linux 9.3:
  ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/perl-spamassassin -3.0.4-1.1.i586.rpm


• SuSE perl-spamassassin-3.0.4-1.1.x86_64.rpm
  SUSE Linux 9.3:
  ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/x86_64/perl-spamassass in-3.0.4-1.1.x86_64.rpm


• SuSE spamassassin-3.0.4-1.1.i586.rpm
  SUSE Linux 9.3:
  ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/i586/spamassassin-3.0. 4-1.1.i586.rpm


• SuSE spamassassin-3.0.4-1.1.x86_64.rpm
  SUSE Linux 9.3:
  ftp://ftp.suse.com/pub/suse/i386/update/9.3/rpm/x86_64/spamassassin-3. 0.4-1.1.x86_64.rpm

SpamAssassin SpamAssassin 3.0.3

• Debian spamassassin_3.0.3-2_all.deb
  Debian 3.1 (sarge)
  http://security.debian.org/pool/updates/main/s/spamassassin/spamassass in_3.0.3-2_all.deb


• Debian spamc_3.0.3-2_alpha.deb
  Debian 3.1 (sarge)
  http://security.debian.org/pool/updates/main/s/spamassassin/spamc_3.0. 3-2_alpha.deb


• Debian spamc_3.0.3-2_i386.deb
  Debian 3.1 (sarge)
  http://security.debian.org/pool/updates/main/s/spamassassin/spamc_3.0. 3-2_i386.deb


• Debian spamc_3.0.3-2_ia64.deb
  Debian 3.1 (sarge)
  http://security.debian.org/pool/updates/main/s/spamassassin/spamc_3.0. 3-2_ia64.deb


• Debian spamc_3.0.3-2_m68k.deb
  Debian 3.1 (sarge)
  http://security.debian.org/pool/updates/main/s/spamassassin/spamc_3.0. 3-2_m68k.deb


• Debian spamc_3.0.3-2_mips.deb
  Debian 3.1 (sarge)
  http://security.debian.org/pool/updates/main/s/spamassassin/spamc_3.0. 3-2_mips.deb


• Debian spamc_3.0.3-2_mipsel.deb
  Debian 3.1 (sarge)
  http://security.debian.org/pool/updates/main/s/spamassassin/spamc_3.0. 3-2_mipsel.deb


• Debian spamc_3.0.3-2_powerpc.deb
  Debian 3.1 (sarge)
  http://security.debian.org/pool/updates/main/s/spamassassin/spamc_3.0. 3-2_powerpc.deb


• Debian spamc_3.0.3-2_s390.deb
  Debian 3.1 (sarge)
  http://security.debian.org/pool/updates/main/s/spamassassin/spamc_3.0. 3-2_s390.deb


• Debian spamc_3.0.3-2_sparc.deb
  Debian 3.1 (sarge)
  http://security.debian.org/pool/updates/main/s/spamassassin/spamc_3.0. 3-2_sparc.deb


• Debian spamc_3.0.3-2_amd64.deb
  Debian GNU/Linux 3.1 alias sarge
  http://security.debian.org/pool/updates/main/s/spamassassin/spamc_3.0. 3-2_amd64.deb


• Debian spamc_3.0.3-2_arm.deb
  Debian 3.0 (woody)
  http://security.debian.org/pool/updates/main/s/spamassassin/spamc_3.0. 3-2_arm.deb


• Debian spamc_3.0.3-2_hppa.deb
  Debian 3.1 (sarge)
  http://security.debian.org/pool/updates/main/s/spamassassin/spamc_3.0. 3-2_hppa.deb


• Fedora spamassassin-3.0.4-1.fc4.i386.rpm
  RedHat Fedora Core 4
  http://download.fedora.redhat.com/pub/fedora/linux/core/updates/4/


• Fedora spamassassin-3.0.4-1.fc4.ppc.rpm
  RedHat Fedora Core 4
  http://download.fedora.redhat.com/pub/fedora/linux/core/updates/4/


• Fedora spamassassin-3.0.4-1.fc4.x86_64.rpm
  RedHat Fedora Core 4
  http://download.fedora.redhat.com/pub/fedora/linux/core/updates/4/


• Fedora spamassassin-debuginfo-3.0.4-1.fc4.i386.rpm
  RedHat Fedora Core 4
  http://download.fedora.redhat.com/pub/fedora/linux/core/updates/4/


• Fedora spamassassin-debuginfo-3.0.4-1.fc4.ppc.rpm
  RedHat Fedora Core 4
  http://download.fedora.redhat.com/pub/fedora/linux/core/updates/4/


• Fedora spamassassin-debuginfo-3.0.4-1.fc4.x86_64.rpm
  RedHat Fedora Core 4
  http://download.fedora.redhat.com/pub/fedora/linux/core/updates/4/


• SpamAssassin Mail-SpamAssassin-3.0.4.tar.gz
  http://apache.mirror.cygnal.ca/spamassassin/source/Mail-SpamAssassin-3 .0.4.tar.gz

SpamAssassin Malformed Email Header Remote Denial Of Service Vulnerability

References:

• [SA-Announce] SpamAssassin 2.64 is released! (SpamAssassin)
  
• Denial of Service Vulnerability in Apache SpamAssassin 3.0.1-3.0.3 (SpamAssassin)
  
• RHSA-2004:451-05 - spamassassin (RedHat)
  
• RHSA-2005:498-10 spamassassin security update (RedHat)
  
• SpamAssassin 3.0.4 Released (SpamAssassin)
  
• SpamAssassin Home Page (SpamAssassin)