PT-2003-2502 · Apache · Spamassassin

Published 2003-12-31 · Updated 2018-10-19 · CVE-2003-1557

Positive Technologies (AI Summary)

CVSS v2.0

7.6

High

Base vector

AV:N/AC:H/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions SpamAssassin versions 2.40 through 2.43

Description The issue is related to an off-by-one buffer overflow in the spamc component of SpamAssassin. This occurs when the software is used in BSMTP mode, denoted by the "-B" option. The overflow can be triggered by remote attackers sending emails that contain headers with leading "." characters, potentially allowing the execution of arbitrary code.

Recommendations For SpamAssassin versions 2.40 through 2.43, consider disabling the BSMTP mode until a patch is available. Restrict access to the spamc component to minimize the risk of exploitation. Avoid using the "-B" option in the affected versions to prevent potential attacks.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2003-1557

Affected Products

Spamassassin

References · 10

• http://securityfocus.com/bid/6679 · Patch
• http://securityfocus.com/archive/1/309912/30/26090/threaded · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2003-1557 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2003-1557 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2003-1557 · Vendor Advisory
• http://secunia.com/advisories/7983 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2003-1557 · Security Note
• http://securityfocus.com/archive/1/310212/30/26030/threaded · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/11154 · Note
• http://marc.info/?l=bugtraq&m=104342896818777&w=2 · Note