Apache SpamAssassin 3.0.1, 3.0.2, and 3.0.3 allows remote attackers to cause a denial of service (CPU consumption and slowdown) via a message with a long Content-Type header without any boundaries.

This advisory adds security support for the stable amd64 distribution.
It covers all security updates since the release of sarge, which were missing updated packages for the not yet official amd64 port. Future security advisories will include updates for this port as well.

An updated spamassassin package that fixes a denial of service bug when parsing malformed messages is now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

SpamAssassin provides a way to reduce unsolicited commercial email (SPAM) from incoming email.

A denial of service bug has been found in SpamAssassin. An attacker could construct a message in such a way that would cause SpamAssassin to consume CPU resources. If a number of these messages were sent it could lead to a denial of service, potentially preventing the delivery or filtering of email. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-1266 to this issue.

SpamAssassin version 3.0.4 additionally solves a number of bugs including: - #156390 Spamassassin consumes too much memory during learning - #155423 URI blacklist spam bypass - #147464 Users may now disable subject rewriting - Smarter default Bayes scores - Numerous other bug fixes that improve spam filter accuracy and safety

For full details, please refer to the change details of 3.0.2, 3.0.3, and 3.0.4 in SpamAssassin's online documentation at the following address: http://wiki.apache.org/spamassassin/NextRelease

Users of SpamAssassin should update to this updated package, containing version 3.0.4 which is not vulnerable to this issue and resolves these bugs.

Apache SpamAssassin Security Team reports :

Apache SpamAssassin 3.0.4 was recently released, and fixes a denial of service vulnerability in versions 3.0.1, 3.0.2, and 3.0.3. The vulnerability allows certain misformatted long message headers to cause spam checking to take a very long time.

While the exploit has yet to be seen in the wild, we are concerned that there may be attempts to abuse the vulnerability in the future.
Therefore, we strongly recommend all users of these versions upgrade to Apache SpamAssassin 3.0.4 as soon as possible.

A vulnerability was recently found in the way that SpamAssassin parses certain email headers. This vulnerability could cause SpamAssassin to consume a large number of CPU cycles when processing messages containing these headers, leading to a potential denial of service (DOS) attack. 

The version of SpamAssassin in the old stable distribution (woody) is not vulnerable.

A Denial of Service bug was discovered in SpamAssassin. An attacker could construct a particular message that would cause SpamAssassin to consume CPU resources. If a large number of these messages were sent, it could lead to a DoS. SpamAssassin 3.0.4 was released to correct this vulnerability, as well as other minor bug fixes, and is provided with this update.

For full details on the changes from previous versions of SpamAssassin to this current version, please refer to the online documentation at http://wiki.apache.org/spamassassin/NextRelease.

The remote Redhat Enterprise Linux 4 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2005:498 advisory.

    SpamAssassin provides a way to reduce unsolicited commercial email (SPAM)     from incoming email.

    A denial of service bug has been found in SpamAssassin.  An attacker could     construct a message in such a way that would cause SpamAssassin to consume     CPU resources.  If a number of these messages were sent it could lead to a     denial of service, potentially  preventing the delivery or filtering of     email. The Common Vulnerabilities and Exposures project (cve.mitre.org) has     assigned the name CAN-2005-1266 to this issue.

    SpamAssassin version 3.0.4 additionally solves a number of bugs including:
    - #156390 Spamassassin consumes too much memory during learning
    - #155423 URI blacklist spam bypass
    - #147464 Users may now disable subject rewriting
    - Smarter default Bayes scores
    - Numerous other bug fixes that improve spam filter accuracy and safety

    For full details, please refer to the change details of 3.0.2, 3.0.3, and     3.0.4 in SpamAssassin's online documentation at the following address:
    http://wiki.apache.org/spamassassin/NextRelease

    Users of SpamAssassin should update to this updated package, containing     version 3.0.4 which is not vulnerable to this issue and resolves these bugs.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-200506-17 (SpamAssassin 3, Vipul's Razor: Denial of Service vulnerability)

    SpamAssassin and Vipul's Razor contain a Denial of Service     vulnerability when handling special misformatted long message headers.
  Impact :

    By sending a specially crafted message an attacker could cause a Denial     of Service attack against the SpamAssassin/Vipul's Razor server.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Severity
57528	Debian DSA-773-1 : amd64 - several vulnerabilities	Nessus	Debian Local Security Checks	critical
21940	CentOS 4 : spamassassin (CESA-2005:498)	Nessus	CentOS Local Security Checks	medium
19123	FreeBSD : p5-Mail-SpamAssassin -- denial of service vulnerability (cc4ce06b-e01c-11d9-a8bd-000cf18bbe54)	Nessus	FreeBSD Local Security Checks	medium
18596	Debian DSA-736-1 : spamassassin - remote denial of service	Nessus	Debian Local Security Checks	medium
18583	Mandrake Linux Security Advisory : spamassassin (MDKSA-2005:106)	Nessus	Mandriva Local Security Checks	medium
18554	RHEL 4 : spamassassin (RHSA-2005:498)	Nessus	Red Hat Local Security Checks	high
18538	GLSA-200506-17 : SpamAssassin 3, Vipul's Razor: Denial of Service vulnerability	Nessus	Gentoo Local Security Checks	medium

Detections

Analytics

CVE-2005-1266

high

Tenable Plugins

critical

medium

medium

medium

medium

high

medium