Apache SpamAssassin Security Team reports :

Apache SpamAssassin 3.0.4 was recently released, and fixes a denial of service vulnerability in versions 3.0.1, 3.0.2, and 3.0.3. The vulnerability allows certain misformatted long message headers to cause spam checking to take a very long time.

While the exploit has yet to be seen in the wild, we are concerned that there may be attempts to abuse the vulnerability in the future.
Therefore, we strongly recommend all users of these versions upgrade to Apache SpamAssassin 3.0.4 as soon as possible.

The remote Redhat Enterprise Linux 4 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2005:498 advisory.

  - security flaw (CVE-2005-1266)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

A Denial of Service bug was discovered in SpamAssassin. An attacker could construct a particular message that would cause SpamAssassin to consume CPU resources. If a large number of these messages were sent, it could lead to a DoS. SpamAssassin 3.0.4 was released to correct this vulnerability, as well as other minor bug fixes, and is provided with this update.

For full details on the changes from previous versions of SpamAssassin to this current version, please refer to the online documentation at http://wiki.apache.org/spamassassin/NextRelease.

このアドバイザリは、安定版（stable）amd64 ディストリビューションのセキュリティサポートを追加します。
sarge リリース以降のすべてのセキュリティ更新がカバーされます。これには、まだ正式ではない amd64 ポートに対する更新済みパッケージがありませんでした。今後のセキュリティアドバイザリには、このポートの更新も含まれる予定です。

此公告會新增對穩定之 amd64 發行版本的安全性支援。
其中包含自 sarge 發佈以來的所有安全性更新，但缺少非官方 amd64 連接埠的更新版套件。之後的安全性公告也將包含此連接埠的更新。

此公告添加了对稳定 amd64 发行版本的安全支持。
它涵盖自 sarge 发布以来的所有安全更新，该版本缺少针对尚不是官方 amd64 端口的更新后的程序包。未来的安全公告将也包含此端口的更新。

A vulnerability was recently found in the way that SpamAssassin parses certain email headers. This vulnerability could cause SpamAssassin to consume a large number of CPU cycles when processing messages containing these headers, leading to a potential denial of service (DOS) attack. 

The version of SpamAssassin in the old stable distribution (woody) is not vulnerable.

The remote host is affected by the vulnerability described in GLSA-200506-17 (SpamAssassin 3, Vipul's Razor: Denial of Service vulnerability)

    SpamAssassin and Vipul's Razor contain a Denial of Service     vulnerability when handling special misformatted long message headers.
  Impact :

    By sending a specially crafted message an attacker could cause a Denial     of Service attack against the SpamAssassin/Vipul's Razor server.
  Workaround :

    There is no known workaround at this time.

An updated spamassassin package that fixes a denial of service bug when parsing malformed messages is now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

SpamAssassin provides a way to reduce unsolicited commercial email (SPAM) from incoming email.

A denial of service bug has been found in SpamAssassin. An attacker could construct a message in such a way that would cause SpamAssassin to consume CPU resources. If a number of these messages were sent it could lead to a denial of service, potentially preventing the delivery or filtering of email. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-1266 to this issue.

SpamAssassin version 3.0.4 additionally solves a number of bugs including: - #156390 Spamassassin consumes too much memory during learning - #155423 URI blacklist spam bypass - #147464 Users may now disable subject rewriting - Smarter default Bayes scores - Numerous other bug fixes that improve spam filter accuracy and safety

For full details, please refer to the change details of 3.0.2, 3.0.3, and 3.0.4 in SpamAssassin's online documentation at the following address: http://wiki.apache.org/spamassassin/NextRelease

Users of SpamAssassin should update to this updated package, containing version 3.0.4 which is not vulnerable to this issue and resolves these bugs.

This advisory adds security support for the stable amd64 distribution.
It covers all security updates since the release of sarge, which were missing updated packages for the not yet official amd64 port. Future security advisories will include updates for this port as well.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
19123	FreeBSD : p5-Mail-SpamAssassin -- denial of service vulnerability (cc4ce06b-e01c-11d9-a8bd-000cf18bbe54)	Nessus	FreeBSD Local Security Checks	2005/7/13	2021/1/6	medium
18554	RHEL 4 : spamassassin (RHSA-2005:498)	Nessus	Red Hat Local Security Checks	2005/6/24	2024/4/21	high
18583	Mandrake Linux Security Advisory : spamassassin (MDKSA-2005:106)	Nessus	Mandriva Local Security Checks	2005/6/28	2021/1/6	medium
57528	Debian DSA-773-1：amd64 - いくつかの脆弱性	Nessus	Debian Local Security Checks	2012/1/12	2021/1/4	critical
57528	Debian DSA-773-1 : amd64 - 數個弱點	Nessus	Debian Local Security Checks	2012/1/12	2021/1/4	critical
57528	Debian DSA-773-1：amd64 - 多个漏洞	Nessus	Debian Local Security Checks	2012/1/12	2021/1/4	critical
18596	Debian DSA-736-1 : spamassassin - remote denial of service	Nessus	Debian Local Security Checks	2005/7/1	2021/1/4	medium
18538	GLSA-200506-17 : SpamAssassin 3, Vipul's Razor: Denial of Service vulnerability	Nessus	Gentoo Local Security Checks	2005/6/21	2021/1/6	medium
21940	CentOS 4 : spamassassin (CESA-2005:498)	Nessus	CentOS Local Security Checks	2006/7/5	2021/1/4	medium
57528	Debian DSA-773-1 : amd64 - several vulnerabilities	Nessus	Debian Local Security Checks	2012/1/12	2021/1/4	critical

検出

プラグインの検索

medium

high

medium

critical

critical

critical

medium

medium

medium

critical