Synopsis

spamassassin security update

Type/Severity

Security Advisory: Moderate

Topic

Updated spamassassin packages that fix an arbitrary code execution flaw
are now available.

This update has been rated as having moderate security impact by the Red
Hat Security Response Team.

Description

SpamAssassin provides a way to reduce unsolicited commercial email (SPAM)
from incoming email.

A flaw was found with the way the Spamassassin spamd daemon processes the
virtual pop username passed to it. If a site is running spamd with both the

• -vpopmail and --paranoid flags, it is possible for a remote user with the
  ability to connect to the spamd daemon to execute arbitrary commands as
  the user running the spamd daemon. (CVE-2006-2447)
  

Note: None of the IMAP or POP servers shipped with Red Hat Enterprise Linux
4 support vpopmail delivery. Running spamd with the --vpopmail and

• -paranoid flags is uncommon and not the default startup option as shipped
  with Red Hat Enterprise Linux 4.
  

Spamassassin, as shipped in Red Hat Enterprise Linux 4, performs RBL
lookups against visi.com to help determine if an email is spam. However,
this DNS RBL has recently disappeared, resulting in mail filtering delays
and timeouts.

Users of SpamAssassin should upgrade to these updated packages containing
version 3.0.6 and backported patches, which are not vulnerable to these issues.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via Red Hat Network. To use Red Hat Network,
launch the Red Hat Update Agent with the following command:

up2date

This will start an interactive process that will result in the appropriate
RPMs being upgraded on your system.

Affected Products

• Red Hat Enterprise Linux Server 4 x86_64
• Red Hat Enterprise Linux Server 4 ia64
• Red Hat Enterprise Linux Server 4 i386
• Red Hat Enterprise Linux Workstation 4 x86_64
• Red Hat Enterprise Linux Workstation 4 ia64
• Red Hat Enterprise Linux Workstation 4 i386
• Red Hat Enterprise Linux Desktop 4 x86_64
• Red Hat Enterprise Linux Desktop 4 i386
• Red Hat Enterprise Linux for IBM z Systems 4 s390x
• Red Hat Enterprise Linux for IBM z Systems 4 s390
• Red Hat Enterprise Linux for Power, big endian 4 ppc

Fixes

• BZ - 178580 - /etc/sysconfig/spamassasin loses file context and timestamp
• BZ - 191033 - spamassassin looks up broken NS domain (visi.com)
• BZ - 193865 - CVE-2006-2447 spamassassin arbitrary command execution

CVEs

• CVE-2006-2447

References

• http://www.redhat.com/security/updates/classification/#moderate

Red Hat Enterprise Linux Server 4

SRPM
spamassassin-3.0.6-1.el4.src.rpm	SHA-256: e31083a28982543f87968fab303a291a532bc215a1d59074477a14e023b0d40e
x86_64
spamassassin-3.0.6-1.el4.x86_64.rpm	SHA-256: e60a7793d21f2cb43cc7f73e2a974bd0cd9b70b46bf5319b3bbd6f30e0613adf
spamassassin-3.0.6-1.el4.x86_64.rpm	SHA-256: e60a7793d21f2cb43cc7f73e2a974bd0cd9b70b46bf5319b3bbd6f30e0613adf
ia64
spamassassin-3.0.6-1.el4.ia64.rpm	SHA-256: 9c60636c202f5f6f27224a9f8eeed49ce17c22a092496eb9c6c5bdd2a9a1816d
spamassassin-3.0.6-1.el4.ia64.rpm	SHA-256: 9c60636c202f5f6f27224a9f8eeed49ce17c22a092496eb9c6c5bdd2a9a1816d
i386
spamassassin-3.0.6-1.el4.i386.rpm	SHA-256: a3a0b1ffbf658600790eefe7dc9b00add5addd86432629b4074c996aaf789751
spamassassin-3.0.6-1.el4.i386.rpm	SHA-256: a3a0b1ffbf658600790eefe7dc9b00add5addd86432629b4074c996aaf789751

Red Hat Enterprise Linux Workstation 4

SRPM
spamassassin-3.0.6-1.el4.src.rpm	SHA-256: e31083a28982543f87968fab303a291a532bc215a1d59074477a14e023b0d40e
x86_64
spamassassin-3.0.6-1.el4.x86_64.rpm	SHA-256: e60a7793d21f2cb43cc7f73e2a974bd0cd9b70b46bf5319b3bbd6f30e0613adf
ia64
spamassassin-3.0.6-1.el4.ia64.rpm	SHA-256: 9c60636c202f5f6f27224a9f8eeed49ce17c22a092496eb9c6c5bdd2a9a1816d
i386
spamassassin-3.0.6-1.el4.i386.rpm	SHA-256: a3a0b1ffbf658600790eefe7dc9b00add5addd86432629b4074c996aaf789751

Red Hat Enterprise Linux Desktop 4

SRPM
spamassassin-3.0.6-1.el4.src.rpm	SHA-256: e31083a28982543f87968fab303a291a532bc215a1d59074477a14e023b0d40e
x86_64
spamassassin-3.0.6-1.el4.x86_64.rpm	SHA-256: e60a7793d21f2cb43cc7f73e2a974bd0cd9b70b46bf5319b3bbd6f30e0613adf
i386
spamassassin-3.0.6-1.el4.i386.rpm	SHA-256: a3a0b1ffbf658600790eefe7dc9b00add5addd86432629b4074c996aaf789751

Red Hat Enterprise Linux for IBM z Systems 4

SRPM
spamassassin-3.0.6-1.el4.src.rpm	SHA-256: e31083a28982543f87968fab303a291a532bc215a1d59074477a14e023b0d40e
s390x
spamassassin-3.0.6-1.el4.s390x.rpm	SHA-256: 9912e0dff0359a86e8786f3dbee8adc4f7b7241f16c6c20f3e9949f56916746b
s390
spamassassin-3.0.6-1.el4.s390.rpm	SHA-256: 1a39bdec5ae5d0526587414cba489a050b3eb00dc4fcdbd5c7e7b6255b594737

Red Hat Enterprise Linux for Power, big endian 4

SRPM
spamassassin-3.0.6-1.el4.src.rpm	SHA-256: e31083a28982543f87968fab303a291a532bc215a1d59074477a14e023b0d40e
ppc
spamassassin-3.0.6-1.el4.ppc.rpm	SHA-256: 552f75b38d9c4c1373fcba5068e57630e86df306c935b4cdb0fdad1b90ba0a81