OpenSMTPD before 6.6.4 allows remote code execution because of an out-of-bounds read in mta_io in mta_session.c for multi-line replies. Although this vulnerability affects the client side of OpenSMTPD, it is possible to attack a server because the server code launches the client code during bounce handling.

The remote Ubuntu 16.04 ESM host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4875-1 advisory.

  - smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote     attackers to execute arbitrary commands as root via a crafted SMTP session, as demonstrated by shell     metacharacters in a MAIL FROM field. This affects the uncommented default configuration. The issue     exists because of an incorrect return value upon failure of input validation. (CVE-2020-7247)

  - OpenSMTPD before 6.6.4 allows local users to read arbitrary files (e.g., on some Linux distributions)     because of a combination of an untrusted search path in makemap.c and race conditions in the offline     functionality in smtpd.c. (CVE-2020-8793)

  - OpenSMTPD before 6.6.4 allows remote code execution because of an out-of-bounds read in mta_io in     mta_session.c for multi-line replies. Although this vulnerability affects the client side of OpenSMTPD, it     is possible to attack a server because the server code launches the client code during bounce handling.
    (CVE-2020-8794)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It was discovered that OpenSMTPD mishandled certain input. A remote, unauthenticated attacker could use this vulnerability to execute arbitrary shell commands as any non-root user. (CVE-2020-8794)

It was discovered that OpenSMTPD did not properly handle hardlinks under certain conditions. An unprivileged local attacker could read the first line of any file on the filesystem. (CVE-2020-8793).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Qualys discovered that the OpenSMTPD SMTP server performed insufficient validation of SMTP commands, which could result in local privilege escalation or the execution of arbitrary code.

OpenSMTPD developers reports :

An out of bounds read in smtpd allows an attacker to inject arbitrary commands into the envelope file which are then executed as root.
Separately, missing privilege revocation in smtpctl allows arbitrary commands to be run with the _smtpq group.

An unprivileged local attacker can read the first line of an arbitrary file (for example, root's password hash in /etc/master.passwd) or the entire contents of another user's file (if this file and /var/spool/smtpd/ are on the same filesystem).

ID	Name	Product	Family	Severity
183572	Ubuntu 16.04 ESM : OpenSMTPD vulnerabilities (USN-4875-1)	Nessus	Ubuntu Local Security Checks	critical
134299	Ubuntu 18.04 LTS : OpenSMTPD vulnerabilities (USN-4294-1)	Nessus	Ubuntu Local Security Checks	critical
134094	Debian DSA-4634-1 : opensmtpd - security update	Nessus	Debian Local Security Checks	critical
133973	FreeBSD : OpenSMTPd -- LPE and RCE in OpenSMTPD's default install (f0683976-5779-11ea-8a77-1c872ccb1e42)	Nessus	FreeBSD Local Security Checks	critical
133970	FreeBSD : OpenSMTPd -- LPE and RCE in OpenSMTPD's default install (40c75597-574a-11ea-bff8-c85b76ce9b5a)	Nessus	FreeBSD Local Security Checks	critical

Detections

Analytics

CVE-2020-8794

critical

Tenable Plugins

critical

critical

critical

critical

critical