Bug 243455 - (CVE-2007-2873) CVE-2007-2873 spamassassin symlink attack
CVE-2007-2873 spamassassin symlink attack
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
All Linux
medium Severity medium
: ---
: ---
Assigned To: Red Hat Product Security
: Security
: 243915 (view as bug list)
Depends On: 243456 243457 243458 243460 243461
  Show dependency treegraph
Reported: 2007-06-08 15:44 EDT by Mark J. Cox (Product Security)
Modified: 2007-06-20 10:03 EDT (History)
3 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2007-06-14 08:39:56 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description Mark J. Cox (Product Security) 2007-06-08 15:44:34 EDT
A local user symlink-attack DoS vulnerability in SpamAssassin has been found,
affecting versions 3.1.x, 3.2.0, and SVN trunk.  It has been assigned
CVE-2007-2873. Details:

- It only affects systems where spamd is run as root, is used with vpopmail or
  virtual users via the "-v"/"--vpopmail" OR "--virtual-config-dir" switch, AND
  with the "-x"/"--no-user-config AND WITHOUT the "-u"/"--username" switch AND
  with the "-l"/"--allow-tell" switch.

  This is not default on any distro package, and is not a common configuration.

- It is a local exploit that requires the attacker to have a local account
  whose mail is being processed by spamd.

- The effect of the exploit is to allow overwriting of arbitrary files that are
  accessible by the spamd process (running as root), with data that is not
  under the control of the attacker.  Hence it is a DoS vulnerability that does
  not allow remote execution nor escalation of local privileges.

Workaround: If you are running spamd using a vulnerable combination of
add the "-u" / "--username" switch to specify a non-root user that spamd child
processes will run as.

Note that in a mixed real/virtual user environment you will now have to run two
separate instances of spamd on different ports, with the instance that
specifies "-v"/"--vpopmail" or "--virtual-config-dir" also specifying

Fix: The vulnerability is fixed in SpamAssassin version 3.2.1 by, among other
fixes, no longer allowing the use of "-v"/"--vpopmail" or
"--virtual-config-dir" without the "-u"/"--username" switch.  Thus, the
configuration change described in the above workaround is still necessary when
upgrading to 3.2.1.

Further info: mail <security at SpamAssassin.apache.org>
Announced: [TODO: not yet public]
Corrected: [TODO: not yet checked into SVN]
Affects: all versions before the correction date, after and including 3.1.0
Credit: discovery of this vulnerability credited to Martin F. Krafft 
  <bugzilla.spamassassin.org at pobox.madduck.net>.

Embargoed, public on 20070611
Comment 1 Mark J. Cox (Product Security) 2007-06-11 17:09:20 EDT
now public at http://spamassassin.apache.org/advisories/cve-2007-2873.txt
removing embargo
Comment 2 Lubomir Kundrak 2007-06-12 14:32:27 EDT
*** Bug 243915 has been marked as a duplicate of this bug. ***

Note You need to log in before you can comment on or make changes to this bug.