Bug 194290 – CVE-2006-2447 spamassassin arbitrary command execution

Bug 194290 - CVE-2006-2447 spamassassin arbitrary command execution

Summary:	CVE-2006-2447 spamassassin arbitrary command execution

Status:	CLOSED CURRENTRELEASE

Aliases:	None

Product:	Fedora
Classification:	Fedora
Component:	spamassassin (Show other bugs)
Sub Component:
Version:	5
Hardware:	All Linux

Priority	medium Severity medium
Target Milestone:	---
Target Release:	---
Assigned To:	Warren Togami
QA Contact:
Docs Contact:

URL:
Whiteboard:	impact=moderate,source=apache,public=...
Keywords:	Security

Depends On:
Blocks:
	Show dependency tree / graph

Reported:	2006-06-06 17:15 EDT by Josh Bressers
Modified:	2007-11-30 17:11 EST (History)
CC List:	7 users (show)

See Also:
Fixed In Version:	3.0.6 and 3.1.3
Doc Type:	Bug Fix
Doc Text:
Story Points:	---
Clone Of:
Environment:
Last Closed:	2006-06-07 11:37:49 EDT
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

Groups: None (edit)

Description Josh Bressers 2006-06-06 17:15:47 EDT

+++ This bug was initially created as a clone of Bug #193865 +++

CVE-2006-2447 spamassassin arbitrary command execution

If spamd is run with the
"-v" / "--vpopmail" switch, AND with the "-P" / "--paranoid" switch
It becomes possible to execute arbitrary commands as the user spamd is
running as.

This issue is mitigated by the fact that no imap servers as shipped
with RHEL support vpopmail.  These options are also not the default
spamd options when it is started as a service.


This issue should also affect FC4

Comment 1 Warren Togami 2006-06-07 11:37:49 EDT

Pushed updates to FC4 and FC5.

Note You need to log in before you can comment on or make changes to this bug.