CVE-2005-1266
CVSS5.0
发布时间 :2005-06-15 00:00:00
修订时间 :2010-08-21 00:28:22
NMCOPS    

[原文]Apache SpamAssassin 3.0.1, 3.0.2, and 3.0.3 allows remote attackers to cause a denial of service (CPU consumption and slowdown) via a message with a long Content-Type header without any boundaries.


[CNNVD]Apache SpamAssassin 远程拒绝服务漏洞(CNNVD-200506-137)

        Apache SpamAssassin 3.0.1, 3.0.2和3.0.3版本中,远程攻击者可借助一条无界的带有长整型内容类型头的消息来触发拒绝服务攻击(CPU消耗和减速)。

- CVSS (基础分值)

CVSS分值: 5 [中等(MEDIUM)]
机密性影响: NONE [对系统的机密性无影响]
完整性影响: NONE [不会对系统完整性产生影响]
可用性影响: PARTIAL [可能会导致性能下降或中断资源访问]
攻击复杂度: LOW [漏洞利用没有访问限制 ]
攻击向量: [--]
身份认证: NONE [漏洞利用无需身份认证]

- CPE (受影响的平台与产品)

cpe:/a:apache:spamassassin:3.0.1Apache Software Foundation SpamAssassin 3.0.1
cpe:/a:apache:spamassassin:3.0.3Apache Software Foundation SpamAssassin 3.0.3
cpe:/a:apache:spamassassin:3.0.2Apache Software Foundation SpamAssassin 3.0.2

- OVAL (用于检测的技术细节)

oval:org.mitre.oval:def:10901Apache SpamAssassin 3.0.1, 3.0.2, and 3.0.3 allows remote attackers to cause a denial of service (CPU consumption and slowdown) via a messag...
*OVAL详细的描述了检测该漏洞的方法,你可以从相关的OVAL定义中找到更多检测该漏洞的技术细节。

- 官方数据库链接

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-1266
(官方数据源) MITRE
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2005-1266
(官方数据源) NVD
http://www.cnnvd.org.cn/vulnerability/show/cv_cnnvdid/CNNVD-200506-137
(官方数据源) CNNVD

- 其它链接及资源

http://www.vuxml.org/freebsd/cc4ce06b-e01c-11d9-a8bd-000cf18bbe54.html
(PATCH)  CONFIRM  http://www.vuxml.org/freebsd/cc4ce06b-e01c-11d9-a8bd-000cf18bbe54.html
http://security.gentoo.org/glsa/glsa-200506-17.xml
(PATCH)  GENTOO  GLSA-200506-17
http://bugs.gentoo.org/show_bug.cgi?id=94722
(PATCH)  MISC  http://bugs.gentoo.org/show_bug.cgi?id=94722
http://www.mandriva.com/security/advisories?name=MDKSA-2005:106
(UNKNOWN)  MANDRAKE  MDKSA-2005:106
http://www.debian.org/security/2005/dsa-736
(UNKNOWN)  DEBIAN  DSA-736
http://mail-archives.apache.org/mod_mbox/spamassassin-announce/200506.mbox/%3c17072.35054.586017.822288@proton.pathname.com%3e
(UNKNOWN)  MLIST  [spamassassin-announce] 20050615 Denial of Service Vulnerability in Apache SpamAssassin 3.0.1-3.0.3
http://www.securityfocus.com/bid/13978
(UNKNOWN)  BID  13978
http://www.redhat.com/support/errata/RHSA-2005-498.html
(UNKNOWN)  REDHAT  RHSA-2005:498

- 漏洞信息

Apache SpamAssassin 远程拒绝服务漏洞
中危 其他
2005-06-15 00:00:00 2005-10-20 00:00:00
远程  
        Apache SpamAssassin 3.0.1, 3.0.2和3.0.3版本中,远程攻击者可借助一条无界的带有长整型内容类型头的消息来触发拒绝服务攻击(CPU消耗和减速)。

- 公告与补丁

        目前厂商已经发布了升级补丁以修复这个安全问题,补丁下载链接:
        SpamAssassin SpamAssassin 2.40
        SpamAssassin Mail-SpamAssassin-2.64.tar.gz
        http://old.spamassassin.org/released/Mail-SpamAssassin-2.64.tar.gz
        SpamAssassin SpamAssassin 2.41 0
        SpamAssassin Mail-SpamAssassin-2.64.tar.gz
        http://old.spamassassin.org/released/Mail-SpamAssassin-2.64.tar.gz
        SpamAssassin SpamAssassin 2.42 0
        SpamAssassin Mail-SpamAssassin-2.64.tar.gz
        http://old.spamassassin.org/released/Mail-SpamAssassin-2.64.tar.gz
        SpamAssassin SpamAssassin 2.43 0
        SpamAssassin Mail-SpamAssassin-2.64.tar.gz
        http://old.spamassassin.org/released/Mail-SpamAssassin-2.64.tar.gz
        SpamAssassin SpamAssassin 2.44
        Mandrake perl-Mail-SpamAssassin-2.44-1.1.91mdk.i586.rpm
        Mandrake Linux 9.1
        http://www.mandrakesecure.net/en/ftp.php
        Mandrake perl-Mail-SpamAssassin-2.44-1.1.91mdk.ppc.rpm
        Mandrake Linux 9.1/PPC
        http://www.mandrakesecure.net/en/ftp.php
        Mandrake perl-Mail-SpamAssassin-2.53-1.1.C21mdk.x86_64.rpm
        Mandrake Corporate Server 2.1/X86_64
        http://www.mandrakesecure.net/en/ftp.php
        Mandrake spamassassin-2.44-1.1.91mdk.i586.rpm
        Mandrake Linux 9.1
        http://www.mandrakesecure.net/en/ftp.php
        Mandrake spamassassin-2.44-1.1.91mdk.ppc.rpm
        Mandrake Linux 9.1/PPC
        http://www.mandrakesecure.net/en/ftp.php
        Mandrake spamassassin-2.53-1.1.C21mdk.x86_64.rpm
        Mandrake Corporate Server 2.1/X86_64
        http://www.mandrakesecure.net/en/ftp.php
        Mandrake spamassassin-tools-2.44-1.1.91mdk.i586.rpm
        Mandrake Linux 9.1
        http://www.mandrakesecure.net/en/ftp.php
        Mandrake spamassassin-tools-2.44-1.1.91mdk.ppc.rpm
        Mandrake Linux 9.1/PPC
        http://www.mandrakesecure.net/en/ftp.php
        Mandrake spamassassin-tools-2.53-1.1.C21mdk.x86_64.rpm
        Mandrake Corporate Server 2.1/X86_64
        http://www.mandrakesecure.net/en/ftp.php
        SpamAssassin Mail-SpamAssassin-2.64.tar.gz
        http://old.spamassassin.org/released/Mail-SpamAssassin-2.64.tar.gz
        SpamAssassin SpamAssassin 2.50 0
        SpamAssassin Mail-SpamAssassin-2.64.tar.gz
        http://old.spamassassin.org/released/Mail-SpamAssassin-2.64.tar.gz
        SpamAssassin SpamAssassin 2.55
        Mandrake perl-Mail-SpamAssassin-2.55-2.1.92mdk.amd64.rpm
        Mandrake Linux 9.2/AMD64
        http://www.mandrakesecure.net/en/ftp.php
        Mandrake perl-Mail-SpamAssassin-2.55-2.1.92mdk.i586.rpm
        Mandrake Linux 9.2
        http://www.mandrakesecure.net/en/ftp.php
        Mandrake spamassassin-2.55-2.1.92mdk.amd64.rpm
        Mandrake Linux 9.2/AMD64
        http://www.mandrakesecure.net/en/ftp.php
        Mandrake spamassassin-2.55-2.1.92mdk.i586.rpm
        Mandrake Linux 9.2
        http://www.mandrakesecure.net/en/ftp.php
        Mandrake spamassassin-tools-2.55-2.1.92mdk.amd64.rpm
        Mandrake Linux 9.2/AMD64
        http://www.mandrakesecure.net/en/ftp.php
        Mandrake spamassassin-tools-2.55-2.1.92mdk.i586.rpm
        Mandrake Linux 9.2
        http://www.mandrakesecure.net/en/ftp.php
        SpamAssassin SpamAssassin 2.60
        Conectiva spamassassin-2.60-28724U90_2cl.i386.rpm
        ftp://atualizacoes.conectiva.com.br/9/RPMS/spamassassin-2.60-28724U90_ 2cl.i386.rpm
        Conectiva spamassassin-doc-2.60-28724U90_2cl.i386.rpm
        ftp://atualizacoes.conectiva.com.br/9/RPMS/spamassassin-doc-2.60-28724 U90_2cl.i386.rpm
        RedHat spamassassin-2.63-0.2.2.legacy.i386.rpm
        RedHat Fedora Core 1
        http://download.fedoralegacy.org/fedora/1/updates/i386/spamassassin-2. 63-0.2.2.legacy.i386.rpm
        SpamAssassin Mail-SpamAssassin-2.64.tar.gz
        http://old.spamassassin.org/released/Mail-SpamAssassin-2.64.tar.gz
        SpamAssassin SpamAssassin 2.63
        Conectiva spamassassin-2.63-54029U10_2cl.i386.rpm
        ftp://atualizacoes.conectiva.com.br/10/RPMS/spamassassin-2.63-54029U10 _2cl.i386.rpm
        Conectiva spamassassin-doc-2.63-54029U10_2cl.i386.rpm
        ftp://atualizacoes.conectiva.com.br/10/RPMS/spamassassin-doc-2.63-5402 9U10_2cl.i386.rpm
        Mandrake perl-Mail-SpamAssassin-2.63-2.1.100mdk.amd64.rpm
        Mandrake Linux 10.0/AMD64
        http://www.mandrakesecure.net/en/ftp.php
        Mandrake perl-Mail-SpamAssassin-2.63-2.1.100mdk.i586.rpm
        Mandrake Linux 10.0
        http://www.mandrakesecure.net/en/ftp.php
        Mandrake spamassassin-2.63-2.1.100mdk.amd64.rpm
        Mandrake Linux 10.0/AMD64
        http://www.mandrakesecure.net/en/ftp.php
        Mandrake spamassassin-2.63-2.1.100mdk.i586.rpm
        Mandrake Li

- 漏洞信息 (F38544)

Debian Linux Security Advisory 736-2 (PacketStormID:F38544)
2005-07-08 00:00:00
Debian  security.debian.org
advisory,denial of service
linux,debian
CVE-2005-1266
[点击下载]

Debian Security Advisory DSA 736-2 - A vulnerability was recently found in the way that SpamAssassin parses certain email headers. This vulnerability could cause SpamAssassin to consume a large number of CPU cycles when processing messages containing these headers, leading to a potential denial of service (DOS) attack.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- ------------------------------------------------------------------------
Debian Security Advisory DSA 736-2                   security@debian.org
http://www.debian.org/security/                            Michael Stone
July 07, 2005                         http://www.debian.org/security/faq
- ------------------------------------------------------------------------

Package        : spamassassin
Vulnerability  : mail header parsing error
Problem type   : remote DOS
Debian-specific: no
CVE Id(s)      : CAN-2005-1266
Debian Bug     : 314447

A vulnerability was recently found in the way that SpamAssassin parses
certain email headers. This vulnerability could cause SpamAssassin to
consume a large number of CPU cycles when processing messages containing
these headers, leading to a potential denial of service (DOS) attack. 

The version of SpamAssassin in the old stable distribution (woody) is
not vulnerable.

For the stable distribution (sarge), this problem has been fixed in
version 3.0.3-2. Note that packages are not yet ready for certain
architectures; these will be released as they become available.

For the unstable distribution (sid), this problem has been fixed in
version 3.0.4-1.

The only change since DSA 736-1 is the addition of packages for certain
architectures that were not available at the time of the original
advisory.

We recommend that you upgrade your sarge or sid spamassassin package.

Upgrade instructions
- --------------------

wget url
        will fetch the file for you
dpkg -i file.deb
        will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update
        will update the internal database
apt-get upgrade
        will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.


Debian 3.1 (sarge)
- ------------------

  sarge was released for alpha, arm, hppa, i386, ia64, m68k, mips, mipsel, powerpc, s390 and sparc. Packages were released for all but arm and hppa in DSA 736-1.

  arm architecture (ARM)

    http://security.debian.org/pool/updates/main/s/spamassassin/spamc_3.0.3-2_arm.deb
      Size/MD5 checksum:    58362 cf463ef4d601f3f6502f891eef928451

  hppa architecture (HP PA RISC)

    http://security.debian.org/pool/updates/main/s/spamassassin/spamc_3.0.3-2_hppa.deb
      Size/MD5 checksum:    60236 4f6c26a0c8ac1249aa38c17040b18d97


- -------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announce@lists.debian.org
Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)

iQCVAwUBQs3SRw0hVr09l8FJAQInzAP/WDnmR034DGlDy+mFP7Cjz33tSIkGsIGs
7zxjwjd3JOw3BIcK1ULg+fb3MpceSFadn3gg+A4lKPTyy4buhWNo62NMXQ0ITpph
0FmBVcxtylbtUpzVQ1SZ7GVL1gMFkwZdTTO9XTUWFDAxCtXxUIWPW64reWMp1U5n
nD9OvROjvuU=
=nzlJ
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
    

- 漏洞信息 (F38396)

Debian Linux Security Advisory 736-1 (PacketStormID:F38396)
2005-07-01 00:00:00
Debian  security.debian.org
advisory,denial of service
linux,debian
CVE-2005-1266
[点击下载]

Debian Security Advisory DSA 736-1 - A vulnerability was recently found in the way that SpamAssassin parses certain email headers. This vulnerability could cause SpamAssassin to consume a large number of CPU cycles when processing messages containing these headers, leading to a potential denial of service (DOS) attack.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- ------------------------------------------------------------------------
Debian Security Advisory 736-1                       security@debian.org
http://www.debian.org/security/                            Michael Stone
July 01, 2005                         http://www.debian.org/security/faq
- ------------------------------------------------------------------------

Package        : spamassassin
Vulnerability  : mail header parsing error
Problem type   : remote DOS
Debian-specific: no
CVE Id(s)      : CAN-2005-1266
Debian Bug     : 314447

A vulnerability was recently found in the way that SpamAssassin parses
certain email headers. This vulnerability could cause SpamAssassin to
consume a large number of CPU cycles when processing messages containing
these headers, leading to a potential denial of service (DOS) attack. 

The version of SpamAssassin in the old stable distribution (woody) is
not vulnerable.

For the stable distribution (sarge), this problem has been fixed in
version 3.0.3-2. Note that packages are not yet ready for certain
architectures; these will be released as they become available.

For the unstable distribution (sid), this problem has been fixed in
version 3.0.4-1.

We recommend that you upgrade your sarge or sid spamassassin package.

Upgrade instructions
- --------------------

wget url
        will fetch the file for you
dpkg -i file.deb
        will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update
        will update the internal database
apt-get upgrade
        will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.


Debian 3.1 (sarge)
- ------------------

  Source archives:

    http://security.debian.org/pool/updates/main/s/spamassassin/spamassassin_3.0.3-2.diff.gz
      Size/MD5 checksum:    44610 b1b383fc4f9dc0792ecd954fa99aaa56
    http://security.debian.org/pool/updates/main/s/spamassassin/spamassassin_3.0.3.orig.tar.gz
      Size/MD5 checksum:   999558 ca96f23cd1eb7d663ab55db98ef8090c
    http://security.debian.org/pool/updates/main/s/spamassassin/spamassassin_3.0.3-2.dsc
      Size/MD5 checksum:      776 4f3092c679992ad322598f4195f4800c

  Architecture independent packages:

    http://security.debian.org/pool/updates/main/s/spamassassin/spamassassin_3.0.3-2_all.deb
      Size/MD5 checksum:   768948 b2d7f49923aa67d8a016e5a3b3545249

  alpha architecture (DEC Alpha)

    http://security.debian.org/pool/updates/main/s/spamassassin/spamc_3.0.3-2_alpha.deb
      Size/MD5 checksum:    61552 84fcd819583c747545fda079a074d987

  i386 architecture (Intel ia32)

    http://security.debian.org/pool/updates/main/s/spamassassin/spamc_3.0.3-2_i386.deb
      Size/MD5 checksum:    58438 18138ce49c9d249fb5d93487e60481a2

  ia64 architecture (Intel ia64)

    http://security.debian.org/pool/updates/main/s/spamassassin/spamc_3.0.3-2_ia64.deb
      Size/MD5 checksum:    65020 65e214d1922317d511e23c32f7e19ff6

  m68k architecture (Motorola Mc680x0)

    http://security.debian.org/pool/updates/main/s/spamassassin/spamc_3.0.3-2_m68k.deb
      Size/MD5 checksum:    57536 b13aad3cb78a148e8838ddfdb301dbd5

  mips architecture (MIPS (Big Endian))

    http://security.debian.org/pool/updates/main/s/spamassassin/spamc_3.0.3-2_mips.deb
      Size/MD5 checksum:    60228 8578263361ff0e95ed0bddc2493d620e

  mipsel architecture (MIPS (Little Endian))

    http://security.debian.org/pool/updates/main/s/spamassassin/spamc_3.0.3-2_mipsel.deb
      Size/MD5 checksum:    60202 2338edb2f9679396005d490232147b7b

  powerpc architecture (PowerPC)

    http://security.debian.org/pool/updates/main/s/spamassassin/spamc_3.0.3-2_powerpc.deb
      Size/MD5 checksum:    60578 e547e452fc5e7ed28b04065af1b677a0

  s390 architecture (IBM S/390)

    http://security.debian.org/pool/updates/main/s/spamassassin/spamc_3.0.3-2_s390.deb
      Size/MD5 checksum:    59436 32ab8a7fef23ac35912ae51cc22aad29

  sparc architecture (Sun SPARC/UltraSPARC)

    http://security.debian.org/pool/updates/main/s/spamassassin/spamc_3.0.3-2_sparc.deb
      Size/MD5 checksum:    58370 8791b8226b25a0bc5381f39257ecd547

- -------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announce@lists.debian.org
Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)

iQCVAwUBQsSl5w0hVr09l8FJAQJckQP+It+rZFa4xKdZUM5f3OWBXEOUdxbsZ3vB
Q/2V/PHyNOP2xXT81M+ZUXk+Tggi4TuBFaxXfg/gHOuYE7vcfBfT/hpxjvgDgTXI
PDUQSpdRjmPMgQq84eUryJzQNwwXv5iVFjeKDrDTDd3qnBja707XZTUuotYGgUp2
KdvwCAkNzrE=
=TN0J
-----END PGP SIGNATURE-----

    

- 漏洞信息 (F38203)

Gentoo Linux Security Advisory 200506-17 (PacketStormID:F38203)
2005-06-23 00:00:00
Gentoo  security.gentoo.org
advisory,denial of service
linux,gentoo
CVE-2005-1266
[点击下载]

Gentoo Linux Security Advisory GLSA 200506-17 - SpamAssassin and Vipul's Razor contain a Denial of Service vulnerability when handling special misformatted long message headers. Versions less than 3.0.4 are affected.

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory                           GLSA 200506-17
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                                            http://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

  Severity: Normal
     Title: SpamAssassin 3, Vipul's Razor: Denial of Service
            vulnerability
      Date: June 21, 2005
      Bugs: #94722, #95492
        ID: 200506-17

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
========

SpamAssassin and Vipul's Razor are vulnerable to a Denial of Service
attack when handling certain malformed messages.

Background
==========

SpamAssassin is an extensible email filter which is used to identify
junk email. Vipul's Razor is a client for a distributed, collaborative
spam detection and filtering network.

Affected packages
=================

    -------------------------------------------------------------------
     Package                   /  Vulnerable  /             Unaffected
    -------------------------------------------------------------------
  1  mail-filter/spamassassin       < 3.0.4                   >= 3.0.4
                                                               < 3.0.1
  2  mail-filter/razor              < 2.71                     >= 2.71
    -------------------------------------------------------------------
     2 affected packages on all of their supported architectures.
    -------------------------------------------------------------------

Description
===========

SpamAssassin and Vipul's Razor contain a Denial of Service
vulnerability when handling special misformatted long message headers.

Impact
======

By sending a specially crafted message an attacker could cause a Denial
of Service attack against the SpamAssassin/Vipul's Razor server.

Workaround
==========

There is no known workaround at this time.

Resolution
==========

All SpamAssassin users should upgrade to the latest version:

    # emerge --sync
    # emerge --ask --oneshot --verbose ">=mail-filter/spamassassin-3.0.4"

All Vipul's Razor users should upgrade to the latest version:

    # emerge --sync
    # emerge --ask --oneshot --verbose ">=mail-filter/razor-2.71"

References
==========

  [ 1 ] CAN-2005-1266
        http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1266
  [ 2 ] SpamAssassin Announcement
        http://mail-archives.apache.org/mod_mbox/spamassassin-announce/200506.mbox/%3c17072.35054.586017.822288@proton.pathname.com%3e
  [ 3 ] Vipul's Razor Announcement
        http://sourceforge.net/mailarchive/forum.php?thread_id=7520323&forum_id=4259

Availability
============

This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:

  http://security.gentoo.org/glsa/glsa-200506-17.xml

Concerns?
=========

Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
http://bugs.gentoo.org.

License
=======

Copyright 2005 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).

The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.

http://creativecommons.org/licenses/by-sa/2.0
    

- 漏洞信息

17346
SpamAssassin Message Header Processing Overflow DoS
Denial of Service, Input Manipulation
Loss of Integrity, Loss of Availability

- 漏洞描述

Unknown or Incomplete

- 时间线

2005-06-06 Unknow
Unknow Unknow

- 解决方案

Upgrade to version 3.04 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

- 相关参考

- 漏洞作者

Unknown or Incomplete

- 漏洞信息

SpamAssassin Malformed Email Header Remote Denial Of Service Vulnerability
Failure to Handle Exceptional Conditions 13978
Yes No
2005-06-17 12:00:00 2007-03-12 07:14:00
This vulnerability was announced by the vendor.

- 受影响的程序版本

SpamAssassin SpamAssassin 3.0.3
+ Debian Linux 3.1 sparc
+ Debian Linux 3.1 s/390
+ Debian Linux 3.1 ppc
+ Debian Linux 3.1 mipsel
+ Debian Linux 3.1 mips
+ Debian Linux 3.1 m68k
+ Debian Linux 3.1 ia-64
+ Debian Linux 3.1 ia-32
+ Debian Linux 3.1 hppa
+ Debian Linux 3.1 arm
+ Debian Linux 3.1 amd64
+ Debian Linux 3.1 alpha
+ Debian Linux 3.1
SpamAssassin SpamAssassin 3.0.2
SpamAssassin SpamAssassin 3.0.1
SpamAssassin SpamAssassin 2.63
SpamAssassin SpamAssassin 2.60
SpamAssassin SpamAssassin 2.55
SpamAssassin SpamAssassin 2.50 0
SpamAssassin SpamAssassin 2.44
SpamAssassin SpamAssassin 2.43 0
+ Gentoo Linux 1.4 _rc2
+ Gentoo Linux 1.4 _rc1
SpamAssassin SpamAssassin 2.42 0
SpamAssassin SpamAssassin 2.41 0
SpamAssassin SpamAssassin 2.40
S.u.S.E. Linux Professional 9.3 x86_64
S.u.S.E. Linux Professional 9.3
S.u.S.E. Linux Professional 9.2 x86_64
S.u.S.E. Linux Professional 9.2
S.u.S.E. Linux Personal 9.3 x86_64
S.u.S.E. Linux Personal 9.3
S.u.S.E. Linux Personal 9.2 x86_64
S.u.S.E. Linux Personal 9.2
RedHat Enterprise Linux WS 4
RedHat Enterprise Linux ES 4
RedHat Desktop 4.0
Red Hat Fedora Core4
Red Hat Fedora Core3
Red Hat Fedora Core1
Red Hat Enterprise Linux AS 4
Mandriva Linux Mandrake 10.2 x86_64
Mandriva Linux Mandrake 10.2
Mandriva Linux Mandrake 10.1 x86_64
Mandriva Linux Mandrake 10.1
Gentoo Linux
SpamAssassin SpamAssassin 3.0.4
SpamAssassin SpamAssassin 2.64

- 不受影响的程序版本

SpamAssassin SpamAssassin 3.0.4
SpamAssassin SpamAssassin 2.64

- 漏洞讨论

SpamAssassin is prone to a remote denial-of-service vulnerability because the application fails to properly handle overly long email headers.

Further details regarding this vulnerability are currently not available. This BID will be updated as more information is disclosed.

An attacker may cause SpamAssassin to take inordinate amounts of time to check a specially crafted email message. By sending many malicious messages, the attacker may be able to cause extremely large delays in email delivery, denying service to legitimate users.

- 漏洞利用

An exploit is not required.

- 解决方案

The vendor has released version 3.0.4 addressing this issue.


SpamAssassin SpamAssassin 2.40

SpamAssassin SpamAssassin 2.41 0

SpamAssassin SpamAssassin 2.42 0

SpamAssassin SpamAssassin 2.43 0

SpamAssassin SpamAssassin 2.44

SpamAssassin SpamAssassin 2.50 0

SpamAssassin SpamAssassin 2.55

SpamAssassin SpamAssassin 2.60

SpamAssassin SpamAssassin 2.63

SpamAssassin SpamAssassin 3.0.1

SpamAssassin SpamAssassin 3.0.2

SpamAssassin SpamAssassin 3.0.3

- 相关参考

 

 

关于SCAP中文社区

SCAP中文社区是国内第一个以SCAP为主题的中文开放社区。了解更多信息,请查阅[关于本站]

版权声明

CVE/CWE/OVAL均为MITRE公司的注册商标,它们的官方数据源均保存在MITRE公司的相关网站