SecurityTracker.com
Keep Track of the Latest Vulnerabilities
with SecurityTracker!
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 
Sign Up
Sign Up for Your FREE Weekly SecurityTracker E-mail Alert Summary
Instant Alerts
Buy our Premium Vulnerability Notification Service to receive customized, instant alerts
Affiliates
Put SecurityTracker Vulnerability Alerts on Your Web Site -- It's Free!
Partners
Become a Partner and License Our Database or Notification Service
Report a Bug
Report a vulnerability that you have found to SecurityTracker
bugs
@
securitytracker.com





Category:   Application (Security)  >   SpamAssassin Vendors:   spamassassin.org
SpamAssassin Lets Remote Users Deny of Service By Sending Malformed Messages
SecurityTracker Alert ID:  1010903
SecurityTracker URL:  http://securitytracker.com/id/1010903
CVE Reference:   CAN-2004-0796   (Links to External Site)
Updated:  Aug 24 2004
Original Entry Date:  Aug 10 2004
Impact:   Denial of service via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): prior to 2.64
Description:   A vulnerability was reported in SpamAssassin. A remote user can cause denial of service conditions.

The vendor reported that a remote user can send an e-mail message with specially crafted headers to cause a denial of service attack against the SpamAssassin service. No further details were provided.
Impact:   A remote user can cause denial of service conditions on the target system.
Solution:   The vendor has released a fixed version (2.64), available at:

http://old.SpamAssassin.org/released/Mail-SpamAssassin-2.64.tar.gz
http://old.SpamAssassin.org/released/Mail-SpamAssassin-2.64.tar.bz2
http://old.SpamAssassin.org/released/Mail-SpamAssassin-2.64.zip

md5sum of archive files:
a82a9dab95462d102e253edb99091fdd Mail-SpamAssassin-2.64.tar.gz
cd482160ddbe371bbf4fb58b715ebbdf Mail-SpamAssassin-2.64.tar.bz2
82a8f47ad87774b5a94805ed9bc6753b Mail-SpamAssassin-2.64.zip

sha1sum of archive files:
7d5776a7c462c849bc48f12a48ed82dc929ac06f Mail-SpamAssassin-2.64.tar.gz
ea4925c6967249a581c4966d1cefd1a3162eb639 Mail-SpamAssassin-2.64.tar.bz2
5922db581c6ef8026455ecce055f14a25b499a3b Mail-SpamAssassin-2.64.zip
Vendor URL:  www.spamassassin.org/ (Links to External Site)
Cause:   Exception handling error
Underlying OS:   Linux (Any), UNIX (Any)

Message History:   This archive entry has one or more follow-up message(s) listed below.
Aug 10 2004 (Gentoo Issues Fix) SpamAssassin Lets Remote Users Deny of Service By Sending Malformed Messages   (Sune Kloppenborg Jeppesen <jaervosz@gentoo.org>)
Gentoo has released a fix.
Aug 19 2004 (Mandrake Issues Fix) SpamAssassin Lets Remote Users Deny of Service By Sending Malformed Messages   (Mandrake Linux Security Team <security@linux-mandrake.com>)
Mandrake has released a fix.
Sep 30 2004 (Red Hat Issues Fix for RHEL) SpamAssassin Lets Remote Users Deny of Service By Sending Malformed Messages   (bugzilla@redhat.com)
Red Hat has released a fix for Red Hat Enterprise Linux 3.


 Source Message Contents
Date:  2004-08-05 3:49:02
Subject:  [SA-Announce] SpamAssassin 2.64 is released!


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


(**IMPORTANT**: This is not an ASF release; this is a maintainance
release of the older 2.6x stable branch, which is NOT released under
an Apache license.)

SpamAssassin is a mail filter which uses advanced statistical
and heuristic tests to identify spam (also known as unsolicited
commercial/bulk email).

Downloading
- -----------

Pick it up from:

  http://old.SpamAssassin.org/released/Mail-SpamAssassin-2.64.tar.gz
  http://old.SpamAssassin.org/released/Mail-SpamAssassin-2.64.tar.bz2
  http://old.SpamAssassin.org/released/Mail-SpamAssassin-2.64.zip

md5sum of archive files:
a82a9dab95462d102e253edb99091fdd  Mail-SpamAssassin-2.64.tar.gz
cd482160ddbe371bbf4fb58b715ebbdf  Mail-SpamAssassin-2.64.tar.bz2
82a8f47ad87774b5a94805ed9bc6753b  Mail-SpamAssassin-2.64.zip
sha1sum of archive files:
7d5776a7c462c849bc48f12a48ed82dc929ac06f  Mail-SpamAssassin-2.64.tar.gz
ea4925c6967249a581c4966d1cefd1a3162eb639  Mail-SpamAssassin-2.64.tar.bz2
5922db581c6ef8026455ecce055f14a25b499a3b  Mail-SpamAssassin-2.64.zip

Or on CPAN shortly, once the mirrors update.

The release files also have a .asc accompanying them.  The file serves
as an external GPG signature for the given release file.  The signing
key is available via the wwwkeys.pgp.net keyserver, as well as
http://www.spamassassin.org/released/GPG-SIGNING-KEY

The key information is:

pub  1024D/265FA05B 2003-06-09 SpamAssassin Signing Key <release@spamassassin.org>
    Key fingerprint = 26C9 00A4 6DD4 0CD5 AD24  F6D7 DEE0 1987 265F A05B

Summary of major changes since 2.63
- -----------------------------------

  - Security fix prevents a denial of service attack open to certain
    malformed messages; this DoS affects all SpamAssassin 2.5x
    and 2.6x versions to date.
  - Backported several very reliable rules from the SpamAssassin 3.0.0
    codebase.

NOTE: If you are testing SpamAssassin 3.0.0, you need to read the README
file before using this distribution!

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)
Comment: Exmh CVS

iD8DBQFBEa4uQTcbUG5Y7woRApuuAJ4zF4d0DC4USds8f4GMJD75n3QNkwCfT597
e8nZtAaIBLy/tavhETmmGr0=
=2Dt3
-----END PGP SIGNATURE-----



-------------------------------------------------------
This SF.Net email is sponsored by OSTG. Have you noticed the changes on
Linux.com, ITManagersJournal and NewsForge in the past few weeks? Now,
one more big change to announce. We are now OSTG- Open Source Technology
Group. Come see the changes on the new OSTG site. www.ostg.com
_______________________________________________
Spamassassin-announce mailing list
Spamassassin-announce@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/spamassassin-announce


Go to the Top of This SecurityTracker Archive Page



Home   |    View Topics   |    Search   |    Contact Us

Copyright 2013, SecurityGlobal.net LLC