SpamAssassin BSMTP Mode Buffer Overflow Vulnerability
BID:6679
Info
SpamAssassin BSMTP Mode Buffer Overflow Vulnerability
| Bugtraq ID: | 6679 |
| Class: | Boundary Condition Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jan 24 2003 12:00AM |
| Updated: | Jan 24 2003 12:00AM |
| Credit: | This vulnerability was reported by Timo Sirainen <[email protected]>. |
| Vulnerable: |
SpamAssassin SpamAssassin 2.43 0 SpamAssassin SpamAssassin 2.42 0 SpamAssassin SpamAssassin 2.41 0 SpamAssassin SpamAssassin 2.40 |
| Not Vulnerable: |
SpamAssassin SpamAssassin 2.44 |
Discussion
SpamAssassin BSMTP Mode Buffer Overflow Vulnerability
A buffer overflow vulnerability has been reported for SpamAssassin. The vulnerability exists when SpamAssassin has been configured for use with BSMTP processing.
The vulnerability occurs when SpamAssassin is escaping '.' characters when processing email headers. Due to insufficient bounds checking performed by the filter, it is possible for a remote attacker to trigger the buffer overflow condition and execute malicious code.
It should be noted that this issue allows an attacker to write the value of the '.' character to the LSB of the value stored above the affected buffer. Under some circumstances this may be the function's saved frame pointer but the exploitability of this issue is highly volatile.
A buffer overflow vulnerability has been reported for SpamAssassin. The vulnerability exists when SpamAssassin has been configured for use with BSMTP processing.
The vulnerability occurs when SpamAssassin is escaping '.' characters when processing email headers. Due to insufficient bounds checking performed by the filter, it is possible for a remote attacker to trigger the buffer overflow condition and execute malicious code.
It should be noted that this issue allows an attacker to write the value of the '.' character to the LSB of the value stored above the affected buffer. Under some circumstances this may be the function's saved frame pointer but the exploitability of this issue is highly volatile.
Solution / Fix
SpamAssassin BSMTP Mode Buffer Overflow Vulnerability
Solution:
Gentoo Linux has released an advisory. Users who have installed dev-perl/Mail-SpamAssasin are advised to upgrade to Mail-SpamAssasin-2.44 by issuing the following commands:
emerge sync
emerge -u Mail-SpamAssasin
emerge clean
Fixes available:
SpamAssassin SpamAssassin 2.40
SpamAssassin SpamAssassin 2.41 0
SpamAssassin SpamAssassin 2.42 0
SpamAssassin SpamAssassin 2.43 0
Solution:
Gentoo Linux has released an advisory. Users who have installed dev-perl/Mail-SpamAssasin are advised to upgrade to Mail-SpamAssasin-2.44 by issuing the following commands:
emerge sync
emerge -u Mail-SpamAssasin
emerge clean
Fixes available:
SpamAssassin SpamAssassin 2.40
-
SpamAssassin Mail-SpamAssassin-2.44.tar.gz
http://spamassassin.org/released/Mail-SpamAssassin-2.44.tar.gz
SpamAssassin SpamAssassin 2.41 0
-
SpamAssassin Mail-SpamAssassin-2.44.tar.gz
http://spamassassin.org/released/Mail-SpamAssassin-2.44.tar.gz
SpamAssassin SpamAssassin 2.42 0
-
SpamAssassin Mail-SpamAssassin-2.44.tar.gz
http://spamassassin.org/released/Mail-SpamAssassin-2.44.tar.gz
SpamAssassin SpamAssassin 2.43 0
-
SpamAssassin Mail-SpamAssassin-2.44.tar.gz
http://spamassassin.org/released/Mail-SpamAssassin-2.44.tar.gz