Apache SpamAssassin 3.4.2 fixes a local user code injection in the meta rule syntax.

According to the version of the spamassassin package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - Apache SpamAssassin 3.4.2 fixes a local user code     injection in the meta rule syntax.(CVE-2018-11781)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the spamassassin package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - A denial of service vulnerability was identified that     exists in Apache SpamAssassin before 3.4.2. The     vulnerability arises with certain unclosed tags in     emails that cause markup to be handled incorrectly     leading to scan timeouts. In Apache SpamAssassin, using     HTML::Parser, we setup an object and hook into the     begin and end tag event handlers In both cases, the     'open' event is immediately followed by a 'close' event
    - even if the tag *does not* close in the HTML being     parsed. Because of this, we are missing the 'text'     event to deal with the object normally. This can cause     carefully crafted emails that might take more scan time     than expected leading to a Denial of Service. The issue     is possibly a bug or design decision in HTML::Parser     that specifically impacts the way Apache SpamAssassin     uses the module with poorly formed html. The exploit     has been seen in the wild but not believed to have been     purposefully part of a Denial of Service attempt. We     are concerned that there may be attempts to abuse the     vulnerability in the future.(CVE-2017-15705)

  - Apache SpamAssassin 3.4.2 fixes a local user code     injection in the meta rule syntax.(CVE-2018-11781)

  - In Apache SpamAssassin before 3.4.3, a message can be     crafted in a way to use excessive resources. Upgrading     to SA 3.4.3 as soon as possible is the recommended fix     but details will not be shared     publicly.(CVE-2019-12420)

  - A command execution issue was found in Apache     SpamAssassin prior to 3.4.3. Carefully crafted     nefarious Configuration (.cf) files can be configured     to run system commands similar to CVE-2018-11805. This     issue is less stealthy and attempts to exploit the     issue will throw warnings. Thanks to Damian Lukowski at     credativ for reporting the issue ethically. With this     bug unpatched, exploits can be injected in a number of     scenarios though doing so remotely is difficult. In     addition to upgrading to SA 3.4.4, we again recommend     that users should only use update channels or 3rd party     .cf files from trusted places.(CVE-2020-1931)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for spamassassin to version 3.4.2 fixes the following issues :

Security issues fixed :

CVE-2018-11781: Fixed an issue where a local user could inject code in the meta rule syntax (bsc#1108748).

CVE-2018-11780: Fixed a potential remote code execution vulnerability in the PDFInfo plugin (bsc#1108750).

CVE-2017-15705: Fixed a denial of service through unclosed tags in crafted emails (bsc#1108745).

CVE-2016-1238: Fixed an issue where perl would load modules from the current directory (bsc#1108749).

Non-security issues fixed: Use systemd timers instead of cron (bsc#1115411)

Fixed incompatibility with Net::DNS >= 1.01 (bsc#1107765)

Fixed warning about deprecated regex during sa-update (bsc#1069831)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for spamassassin to version 3.4.2 fixes the following issues :

Security issues fixed :

  - CVE-2018-11781: Fixed an issue where a local user could     inject code in the meta rule syntax (bsc#1108748).

  - CVE-2018-11780: Fixed a potential remote code execution     vulnerability in the PDFInfo plugin (bsc#1108750).

  - CVE-2017-15705: Fixed a denial of service through     unclosed tags in crafted emails (bsc#1108745).

  - CVE-2016-1238: Fixed an issue where perl would load     modules from the current directory (bsc#1108749).

Non-security issues fixed :

  - Use systemd timers instead of cron (bsc#1115411)

  - Fixed incompatibility with Net::DNS >= 1.01     (bsc#1107765)

  - Fixed warning about deprecated regex during sa-update     (bsc#1069831)

This update was imported from the SUSE:SLE-15:Update update project.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has spamassassin packages installed that are affected by multiple vulnerabilities:

  - A flaw was found in the way a local user on the     SpamAssassin server could inject code in the meta rule     syntax. This could cause the arbitrary code execution on     the server when these rules are being processed.
    (CVE-2018-11781)

  - A flaw was found in the way SpamAssassin processes HTML     email containing unclosed HTML tags. A carefully crafted     mail message could cause SpamAssassin to consume     significant resources. If a large number of these     messages are sent, a denial of service could occur     potentially delaying or preventing the delivery of     email. (CVE-2017-15705)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for spamassassin to version 3.4.2 fixes the following issues :

Security issues fixed :

CVE-2017-15705: Fixed denial of service via unclosed tags in crafted emails (bsc#1108745).

CVE-2018-11781: Fixed a code injection in the meta rule syntax by local users (bsc#1108748).

CVE-2018-11780: Fixed a potential remote code execution vulnerability in PDFInfo plugin (bsc#1108750).

Non-security issues fixed: Added four new plugins (disabled by default): HashBL, ResourceLimits, FromNameSpoof, Phishing

sa-update script: optional support for SHA-256 / SHA-512 been added for better validation of rules

GeoIP2 support has been added to RelayCountry and URILocalBL plugins

Several new or enhanced configuration options

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Fixed some small bugs in the previous package: Initial rules now have the correct version, sought channel config is dropped (since it doesn't exist anymore) and build / runtime deps adjusted. 

----

Update to 3.4.2. Fixes CVE-2017-15705, CVE-2018-11780 and CVE-2018-11781 along with many other bugfixes and improvements. See https://www.mail-archive.com/announce@apache.org/msg04823.html for more information.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is affected by the vulnerability described in GLSA-201812-07 (SpamAssassin: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in SpamAssassin. Please       review the referenced CVE identifiers for details.
  Impact :

    A remote attacker could execute arbitrary code, escalate privileges, or       cause a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

Multiple vulnerabilities were found in Spamassassin, which could lead to Remote Code Execution and Denial of Service attacks under certain circumstances.

CVE-2016-1238

Many Perl programs do not properly remove . (period) characters from the end of the includes directory array, which might allow local users to gain privileges via a Trojan horse module under the current working directory.

CVE-2017-15705

A denial of service vulnerability was identified that exists in Apache SpamAssassin before 3.4.2. The vulnerability arises with certain unclosed tags in emails that cause markup to be handled incorrectly leading to scan timeouts. This can cause carefully crafted emails that might take more scan time than expected leading to a Denial of Service.

CVE-2018-11780

A potential Remote Code Execution bug exists with the PDFInfo plugin in Apache SpamAssassin before 3.4.2.

CVE-2018-11781

Apache SpamAssassin 3.4.2 fixes a local user code injection in the meta rule syntax.

For Debian 8 'Jessie', these problems have been fixed in version 3.4.2-0+deb8u1. Upstream strongly advocates upgrading to the latest upstream version so we are following that recommendation and backported the version published as part of the 9.6 stretch release, which also fixes many critical bugs.

We recommend that you upgrade your spamassassin packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A flaw was found in the way SpamAssassin processes HTML email containing unclosed HTML tags. A carefully crafted mail message could cause SpamAssassin to consume significant resources. If a large number of these messages are sent, a denial of service could occur potentially delaying or preventing the delivery of email.(CVE-2017-15705)

A flaw was found in the way a local user on the SpamAssassin server could inject code in the meta rule syntax. This could cause the arbitrary code execution on the server when these rules are being processed.(CVE-2018-11781)

It was discovered that SpamAssassin incorrectly handled certain unclosed tags in emails. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2017-15705)

It was discovered that SpamAssassin incorrectly handled the PDFInfo plugin. A remote attacker could possibly use this issue to execute arbitrary code. (CVE-2018-11780)

It was discovered that SpamAssassin incorrectly handled meta rule syntax. A local attacker could possibly use this issue to execute arbitrary code. (CVE-2018-11781).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A flaw was found in the way a local user on the SpamAssassin server could inject code in the meta rule syntax. This could cause the arbitrary code execution on the server when these rules are being processed.(CVE-2018-11781)

A potential Remote Code Execution bug exists with the PDFInfo plugin in Apache SpamAssassin before 3.4.2.(CVE-2018-11780)

A flaw was found in the way SpamAssassin processes HTML email containing unclosed HTML tags. A carefully crafted mail message could cause SpamAssassin to consume significant resources. If a large number of these messages are sent, a denial of service could occur potentially delaying or preventing the delivery of email.(CVE-2017-15705)

An update for spamassassin is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The SpamAssassin tool provides a way to reduce unsolicited commercial email (spam) from incoming email.

Security Fix(es) :

* spamassassin: Certain unclosed tags in crafted emails allow for scan timeouts and result in denial of service (CVE-2017-15705)

* spamassassin: Local user code injection in the meta rule syntax (CVE-2018-11781)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Security Fix(es) :

  - spamassassin: Certain unclosed tags in crafted emails     allow for scan timeouts and result in denial of service     (CVE-2017-15705)

  - spamassassin: Local user code injection in the meta rule     syntax (CVE-2018-11781)

From Red Hat Security Advisory 2018:2916 :

An update for spamassassin is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The SpamAssassin tool provides a way to reduce unsolicited commercial email (spam) from incoming email.

Security Fix(es) :

* spamassassin: Certain unclosed tags in crafted emails allow for scan timeouts and result in denial of service (CVE-2017-15705)

* spamassassin: Local user code injection in the meta rule syntax (CVE-2018-11781)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

the Apache Spamassassin project reports :

In Apache SpamAssassin, using HTML::Parser, we setup an object and hook into the begin and end tag event handlers In both cases, the 'open' event is immediately followed by a 'close' event - even if the tag *does not* close in the HTML being parsed.

Because of this, we are missing the 'text' event to deal with the object normally. This can cause carefully crafted emails that might take more scan time than expected leading to a Denial of Service.

Fix a reliance on '.' in @INC in one configuration script. Whether this can be exploited in any way is uncertain.

Fix a potential Remote Code Execution bug with the PDFInfo plugin.
Thanks to cPanel Security Team for their report of this issue.

Fourth, this release fixes a local user code injection in the meta rule syntax. Thanks again to cPanel Security Team for their report of this issue.

ID	Name	Product	Family	Severity
142345	EulerOS 2.0 SP2 : spamassassin (EulerOS-SA-2020-2397)	Nessus	Huawei Local Security Checks	high
142129	EulerOS 2.0 SP5 : spamassassin (EulerOS-SA-2020-2272)	Nessus	Huawei Local Security Checks	high
140885	EulerOS 2.0 SP3 : spamassassin (EulerOS-SA-2020-2118)	Nessus	Huawei Local Security Checks	high
127751	SUSE SLED15 / SLES15 Security Update : spamassassin (SUSE-SU-2019:2011-1)	Nessus	SuSE Local Security Checks	critical
127739	openSUSE Security Update : spamassassin (openSUSE-2019-1831)	Nessus	SuSE Local Security Checks	critical
127217	NewStart CGSL CORE 5.04 / MAIN 5.04 : spamassassin Multiple Vulnerabilities (NS-SA-2019-0041)	Nessus	NewStart CGSL Local Security Checks	high
127038	SUSE SLED12 / SLES12 Security Update : spamassassin (SUSE-SU-2019:1961-1)	Nessus	SuSE Local Security Checks	critical
120609	Fedora 29 : spamassassin (2018-8f0df2c366)	Nessus	Fedora Local Security Checks	critical
120387	Fedora 28 : spamassassin (2018-46d7a7f63e)	Nessus	Fedora Local Security Checks	critical
119703	GLSA-201812-07 : SpamAssassin: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
118938	Debian DLA-1578-1 : spamassassin security update	Nessus	Debian Local Security Checks	critical
118834	Amazon Linux 2 : spamassassin (ALAS-2018-1103)	Nessus	Amazon Linux Local Security Checks	high
118797	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : SpamAssassin vulnerabilities (USN-3811-1)	Nessus	Ubuntu Local Security Checks	critical
118211	Amazon Linux AMI : spamassassin (ALAS-2018-1091)	Nessus	Amazon Linux Local Security Checks	critical
118117	CentOS 7 : spamassassin (CESA-2018:2916)	Nessus	CentOS Local Security Checks	high
118108	Scientific Linux Security Update : spamassassin on SL7.x x86_64 (20181011)	Nessus	Scientific Linux Local Security Checks	high
118077	RHEL 7 : spamassassin (RHSA-2018:2916)	Nessus	Red Hat Local Security Checks	high
118076	Oracle Linux 7 : spamassassin (ELSA-2018-2916)	Nessus	Oracle Linux Local Security Checks	high
117840	Fedora 27 : spamassassin (2018-6ed251c42b)	Nessus	Fedora Local Security Checks	critical
117721	FreeBSD : spamassassin -- multiple vulnerabilities (613193a0-c1b4-11e8-ae2d-54e1ad3d6335)	Nessus	FreeBSD Local Security Checks	critical

Detections

Analytics

CVE-2018-11781

high

Tenable Plugins

high

high

high

critical

critical

high

critical

critical

critical

critical

critical

high

critical

critical

high

high

high

high

critical

critical