Bug 1784974 (CVE-2018-11805)

Summary:	CVE-2018-11805 spamassassin: crafted configuration files can run system commands without any output or errors
Product:	[Other] Security Response	Reporter:	Guilherme de Almeida Suckevicz <gsuckevi>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	huzaifas, jskarvad, kevin, nb, thozza, zdohnal
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	spamassassin 3.4.3	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2020-11-04 02:23:51 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1784975, 1787513, 1787514
Bug Blocks:	1784977

Description Guilherme de Almeida Suckevicz 2019-12-18 20:29:24 UTC

In Apache SpamAssassin before 3.4.3, nefarious CF files can be configured to run system commands without any output or errors. With this, exploits can be injected in a number of scenarios. In addition to upgrading to SA 3.4.3, we recommend that users should only use update channels or 3rd party .cf files from trusted places.

Reference:
https://lists.apache.org/thread.html/2946b38caec47f7f6a79e8e03d2aa723794186e59a7dc6b5e76dfc18@%3Cannounce.spamassassin.apache.org%3E

Comment 1 Guilherme de Almeida Suckevicz 2019-12-18 20:29:42 UTC

Created spamassassin tracking bugs for this issue:

Affects: fedora-all [bug 1784975]

Comment 3 Huzaifa S. Sidhpurwala 2020-01-03 08:33:58 UTC

Analysis:

The attack is triggered by malicious specially crafted .cf files which are basically configuration files for spamassasin. These files can be located at:
1. /usr/share/spamassassin
2. /etc/mail/spamassassin
3. user's home directory, in a directory called .spamassassin

All of these locations can only be access by the system administrator. In order to successfully exploit this, you really need to social engineer the administrator to use your .cf files and put them at these locations.

Comment 7 Ondřej Lysoněk 2020-01-06 10:23:33 UTC

I did not mean to change the priority/severity. Reverting.

Comment 9 Huzaifa S. Sidhpurwala 2020-01-06 12:31:27 UTC

Statement:

The attack is triggered by malicious specially crafted .cf files which are basically configuration files for spamassasin. These files can be located at:
1. /usr/share/spamassassin
2. /etc/mail/spamassassin
3. user's home directory, in a directory called .spamassassin

All of these locations can only be accessed by either the system administrator or by a user having a local shell account on the machine. In order to successfully exploit this flaw, the attacker needs to convince the user to place the malicious configuration files in one of the above locations.

Comment 15 Huzaifa S. Sidhpurwala 2020-07-30 05:34:21 UTC

Mitigation:

The attack is triggered by malicious specially crafted .cf files which are configuration files for spamassasin. Do not use untrusted configuration files for spamassisin

Comment 16 Product Security DevOps Team 2020-11-04 02:23:51 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2018-11805

Comment 17 errata-xmlrpc 2020-11-04 02:28:23 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2020:4625 https://access.redhat.com/errata/RHSA-2020:4625