SpamAssassin 3.0.4 allows attackers to bypass spam detection via an e-mail with a large number of recipients ("To" addresses), which triggers a bus error in Perl.

An updated spamassassin package that fixes a denial of service flaw is now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

SpamAssassin provides a way to reduce unsolicited commercial email (SPAM) from incoming email.

A denial of service bug was found in SpamAssassin. An attacker could construct a message in such a way that would cause SpamAssassin to crash. If a number of these messages are sent, it could lead to a denial of service, potentially preventing the delivery or filtering of email. The Common Vulnerabilities and Exposures project (cve.mitre.org) assigned the name CVE-2005-3351 to this issue.

The following issues have also been fixed in this update :

* service spamassassin restart sometimes fails * Content Boundary '--' throws off message parser * sa-learn: massive memory usage on large messages * High memory usage with many newlines * service spamassassin messages not translated * Numerous other bug fixes that improve spam filter accuracy and safety

Users of SpamAssassin should upgrade to this updated package containing version 3.0.5, which is not vulnerable to these issues.

SpamAssassin 3.0.4 allows attackers to bypass spam detection via an e-mail with a large number of recipients ('To' addresses), which triggers a bus error in Perl.

Updated packages have been patched to address this issue.

Solves CVE-2005-3351 and a few other minor bugs to improve spam detection accuracy. You could consider this a release candidate for 3.0.5. 

Also solved is #161785 which ensures that 'service spamassassin restart' should never fail.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
21978	CentOS 4 : spamassassin (CESA-2006:0129)	Nessus	CentOS Local Security Checks	medium
21032	RHEL 4 : spamassassin (RHSA-2006:0129)	Nessus	Red Hat Local Security Checks	medium
20452	Mandrake Linux Security Advisory : spamassassin (MDKSA-2005:221)	Nessus	Mandriva Local Security Checks	medium
20189	Fedora Core 3 : spamassassin-3.0.4-2.fc3 (2005-1065)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2005-3351

high

Tenable Plugins

medium

medium

medium

medium