Skip to Content.
Sympa Menu

sm-security - [SM-Security] spamassassin: denial of service vulnerability

sm-security AT lists.ibiblio.org

Subject: Security bugs are reported here via bugzilla

List archive

Chronological Thread  
  • From: Thomas Houssin <Thomas.Houssin AT gmail.com>
  • To: sm-security AT lists.ibiblio.org
  • Subject: [SM-Security] spamassassin: denial of service vulnerability
  • Date: Fri, 24 Jun 2005 21:02:58 +0200

Synopsis
========
spamassassin is prone to a denial-of-service attack. A remote attacker
could craft a MIME E-Mail message that would waste a lot of CPU cycles
parsing the Content-Type header.

Background
==========
spamassassin is a mail filter which attempts to identify spam using text
analysis and several internet-based realtime blacklists.
Using its rule base, it uses a wide range of heuristic tests on mail
headers and body text to identify "spam", also known as unsolicited
commercial email.

Description
===========
CAN-2005-1266:
spamassassin contains a Denial of Service vulnerability when handling
special misformatted long message headers.

Affected packages
=================
spamassassin in all grimoires (devel, test, stable-rc and stable) is
affected.
This is now fixed in all grimoires (spamassassin updated to 3.0.4).

Resolution
==========
All spamassassin users should upgrade to the latest available version:
# scribe update
# cast -c spamassassin

References
==========
[ 1 ] CAN-2005-1266
http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1266


--
Thomas Houssin

Security Team Leader Source Mage GNU/Linux (http://www.sourcemage.org)
Key fingerprint = 3CB8 3FC4 840D B272 E623 BCB8 54DB F4E3 4240 4C36
http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x42404C36

Attachment: signature.asc
Description: OpenPGP digital signature



  • [SM-Security] spamassassin: denial of service vulnerability, Thomas Houssin, 06/24/2005

Archive powered by MHonArc 2.6.24.

Top of Page