smtpd/lka_filter.c in OpenSMTPD before 6.8.0p1, in certain configurations, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted pattern of client activity, because the filter state machine does not properly maintain the I/O channel between the SMTP engine and the filters layer.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - smtpd/lka_filter.c in OpenSMTPD before 6.8.0p1, in certain configurations, allows remote attackers to     cause a denial of service (NULL pointer dereference and daemon crash) via a crafted pattern of client     activity, because the filter state machine does not properly maintain the I/O channel between the SMTP     engine and the filters layer. (CVE-2020-35680)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - smtpd/table.c in OpenSMTPD before 6.8.0p1 lacks a certain regfree, which might allow attackers to trigger
    a "very significant" memory leak via messages to an instance that performs many regex lookups.
    (CVE-2020-35679)

  - smtpd/lka_filter.c in OpenSMTPD before 6.8.0p1, in certain configurations, allows remote attackers to
    cause a denial of service (NULL pointer dereference and daemon crash) via a crafted pattern of client
    activity, because the filter state machine does not properly maintain the I/O channel between the SMTP
    engine and the filters layer. (CVE-2020-35680)

The remote host is affected by the vulnerability described in GLSA-202105-12 (OpenSMTPD: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in OpenSMTPD. Please       review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker, by connecting to the SMTP listener daemon, could       possibly cause a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

The remote Fedora 32 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2021-71fbdecdf8 advisory.

  - smtpd/table.c in OpenSMTPD before 6.8.0p1 lacks a certain regfree, which might allow attackers to trigger     a very significant memory leak via messages to an instance that performs many regex lookups.
    (CVE-2020-35679)

  - smtpd/lka_filter.c in OpenSMTPD before 6.8.0p1, in certain configurations, allows remote attackers to     cause a denial of service (NULL pointer dereference and daemon crash) via a crafted pattern of client     activity, because the filter state machine does not properly maintain the I/O channel between the SMTP     engine and the filters layer. (CVE-2020-35680)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 33 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2021-848fd34b0b advisory.

  - smtpd/table.c in OpenSMTPD before 6.8.0p1 lacks a certain regfree, which might allow attackers to trigger     a very significant memory leak via messages to an instance that performs many regex lookups.
    (CVE-2020-35679)

  - smtpd/lka_filter.c in OpenSMTPD before 6.8.0p1, in certain configurations, allows remote attackers to     cause a denial of service (NULL pointer dereference and daemon crash) via a crafted pattern of client     activity, because the filter state machine does not properly maintain the I/O channel between the SMTP     engine and the filters layer. (CVE-2020-35680)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
255573	Linux Distros Unpatched Vulnerability : CVE-2020-35680	Nessus	Misc.	high
406036	Alpine: multiple opensmtpd packages: security update to 6.7.1p1-r1	Tenable Cloud Security	Alpine Linux Local Security Checks	high
406036	Alpine: multiple opensmtpd packages: security update to 6.7.1p1-r1	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
406035	Alpine: multiple opensmtpd packages: security update to 6.6.4p1-r2	Tenable Cloud Security	Alpine Linux Local Security Checks	high
406035	Alpine: multiple opensmtpd packages: security update to 6.6.4p1-r2	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
406034	Alpine: multiple opensmtpd packages: security update to 6.6.4p1-r1	Tenable Cloud Security	Alpine Linux Local Security Checks	high
406034	Alpine: multiple opensmtpd packages: security update to 6.6.4p1-r1	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
150009	GLSA-202105-12 : OpenSMTPD: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
145780	Fedora 32 : opensmtpd (2021-71fbdecdf8)	Nessus	Fedora Local Security Checks	high
145747	Fedora 33 : opensmtpd (2021-848fd34b0b)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2020-35680

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high