Synopsis

Important: spamassassin security update

Type/Severity

Security Advisory: Important

Topic

Updated spamassassin packages that fix a security issue are now available
for Red Hat Enterprise Linux 4.

This update has been rated as having important security impact by the Red
Hat Security Response Team.

Description

SpamAssassin provides a way to reduce unsolicited commercial email (spam)
from incoming email.

A flaw was found in the way SpamAssassin processes HTML email containing
URIs. A carefully crafted mail message could cause SpamAssassin to consume
significant resources. If a number of these messages are sent, this could
lead to a denial of service, potentially delaying or preventing the
delivery of email.
(CVE-2007-0451)

Users of SpamAssassin should upgrade to these updated packages which
contain version 3.1.8 which is not vulnerable to these issues.

This is an upgrade from SpamAssassin version 3.0.6 to 3.1.8, which contains
many bug fixes and spam detection enhancements. Further details are
available in the SpamAssassin 3.1 changelog and upgrade guide.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via Red Hat Network. To use Red Hat Network,
launch the Red Hat Update Agent with the following command:

up2date

This will start an interactive process that will result in the appropriate
RPMs being upgraded on your system.

Affected Products

• Red Hat Enterprise Linux Server 4 x86_64
• Red Hat Enterprise Linux Server 4 ia64
• Red Hat Enterprise Linux Server 4 i386
• Red Hat Enterprise Linux Workstation 4 x86_64
• Red Hat Enterprise Linux Workstation 4 ia64
• Red Hat Enterprise Linux Workstation 4 i386
• Red Hat Enterprise Linux Desktop 4 x86_64
• Red Hat Enterprise Linux Desktop 4 i386
• Red Hat Enterprise Linux for IBM z Systems 4 s390x
• Red Hat Enterprise Linux for IBM z Systems 4 s390
• Red Hat Enterprise Linux for Power, big endian 4 ppc

Fixes

• BZ - 228586 - CVE-2007-0451 Spamassassin DoS

CVEs

• CVE-2007-0451

References

• http://svn.apache.org/repos/asf/spamassassin/branches/3.1/UPGRADE
• http://svn.apache.org/repos/asf/spamassassin/branches/3.1/Changes
• http://www.redhat.com/security/updates/classification/#important

Red Hat Enterprise Linux Server 4

SRPM
spamassassin-3.1.8-2.el4.src.rpm	SHA-256: 384ca3467909df9133db531ba555b6cf0a90dc8616bf9bb66f33073f2ae5cdbf
x86_64
spamassassin-3.1.8-2.el4.x86_64.rpm	SHA-256: b995594987895af35569b7b3f02f482d5b1a5f772c3730529c982c3a54ade29a
spamassassin-3.1.8-2.el4.x86_64.rpm	SHA-256: b995594987895af35569b7b3f02f482d5b1a5f772c3730529c982c3a54ade29a
ia64
spamassassin-3.1.8-2.el4.ia64.rpm	SHA-256: fb8865ffa3f4442f7b594ae758812aba483c16cdea61663393997168f644e6fa
spamassassin-3.1.8-2.el4.ia64.rpm	SHA-256: fb8865ffa3f4442f7b594ae758812aba483c16cdea61663393997168f644e6fa
i386
spamassassin-3.1.8-2.el4.i386.rpm	SHA-256: 57ae64e63db51ad714ed3b384c08d7b3121b8569d3d8d5124a1920bc7d40cb19
spamassassin-3.1.8-2.el4.i386.rpm	SHA-256: 57ae64e63db51ad714ed3b384c08d7b3121b8569d3d8d5124a1920bc7d40cb19

Red Hat Enterprise Linux Workstation 4

SRPM
spamassassin-3.1.8-2.el4.src.rpm	SHA-256: 384ca3467909df9133db531ba555b6cf0a90dc8616bf9bb66f33073f2ae5cdbf
x86_64
spamassassin-3.1.8-2.el4.x86_64.rpm	SHA-256: b995594987895af35569b7b3f02f482d5b1a5f772c3730529c982c3a54ade29a
ia64
spamassassin-3.1.8-2.el4.ia64.rpm	SHA-256: fb8865ffa3f4442f7b594ae758812aba483c16cdea61663393997168f644e6fa
i386
spamassassin-3.1.8-2.el4.i386.rpm	SHA-256: 57ae64e63db51ad714ed3b384c08d7b3121b8569d3d8d5124a1920bc7d40cb19

Red Hat Enterprise Linux Desktop 4

SRPM
spamassassin-3.1.8-2.el4.src.rpm	SHA-256: 384ca3467909df9133db531ba555b6cf0a90dc8616bf9bb66f33073f2ae5cdbf
x86_64
spamassassin-3.1.8-2.el4.x86_64.rpm	SHA-256: b995594987895af35569b7b3f02f482d5b1a5f772c3730529c982c3a54ade29a
i386
spamassassin-3.1.8-2.el4.i386.rpm	SHA-256: 57ae64e63db51ad714ed3b384c08d7b3121b8569d3d8d5124a1920bc7d40cb19

Red Hat Enterprise Linux for IBM z Systems 4

SRPM
spamassassin-3.1.8-2.el4.src.rpm	SHA-256: 384ca3467909df9133db531ba555b6cf0a90dc8616bf9bb66f33073f2ae5cdbf
s390x
spamassassin-3.1.8-2.el4.s390x.rpm	SHA-256: 5ca86ccb38106dc73970b1c2fc7e23fedaeee88d2bf95426829a004d09004629
s390
spamassassin-3.1.8-2.el4.s390.rpm	SHA-256: f9bbe2464439ff7723919fc9a5a30ee9f8227f688657ba078ceba337e819256a

Red Hat Enterprise Linux for Power, big endian 4

SRPM
spamassassin-3.1.8-2.el4.src.rpm	SHA-256: 384ca3467909df9133db531ba555b6cf0a90dc8616bf9bb66f33073f2ae5cdbf
ppc
spamassassin-3.1.8-2.el4.ppc.rpm	SHA-256: 04e57cd5fd6f9cb7e22a6de7fddb45d25d044deef83b15090aea1895bda98cd9