PT-2003-2502 · Apache · Spamassassin

Publicado 2003-12-31 · Atualizado 2018-10-19 · CVE-2003-1557

Positive Technologies (AI Summary)

CVSS v2.0

7.6

Alta

Vetor base

AV:N/AC:H/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions SpamAssassin versions 2.40 through 2.43

Description The issue is related to an off-by-one buffer overflow in the spamc component of SpamAssassin. This occurs when the software is used in BSMTP mode, denoted by the "-B" option. The overflow can be triggered by remote attackers sending emails that contain headers with leading "." characters, potentially allowing the execution of arbitrary code.

Recommendations For SpamAssassin versions 2.40 through 2.43, consider disabling the BSMTP mode until a patch is available. Restrict access to the spamc component to minimize the risk of exploitation. Avoid using the "-B" option in the affected versions to prevent potential attacks.

Correção

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2003-1557

Produtos afetados

Spamassassin

Referências · 10

• http://securityfocus.com/bid/6679 · Correção
• http://securityfocus.com/archive/1/310212/30/26030/threaded · Nota
• http://securityfocus.com/archive/1/309912/30/26090/threaded · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/11154 · Nota
• https://osv.dev/vulnerability/CVE-2003-1557 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2003-1557 · Aviso do Fabricante
• http://marc.info/?l=bugtraq&m=104342896818777&w=2 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2003-1557 · Aviso do Fabricante
• http://secunia.com/advisories/7983 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2003-1557 · Nota de Segurança