spamassassin: CVE-2005-3351: Bus Error Spam Detection Bypass Vulnerability

Debian Bug report logs - #339526
spamassassin: CVE-2005-3351: Bus Error Spam Detection Bypass Vulnerability

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Geoff Crompton <geoff.crompton@strategicdata.com.au>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: spamassassin: CVE-2005-3351: Bus Error Spam Detection Bypass Vulnerability

Date: Thu, 17 Nov 2005 09:36:05 +1100

Package: spamassassin
Version: 3.0.3-1
Severity: grave
File: spamassassin

Security Focus is reporting a problem with spamassassin: 
http://www.securityfocus.com/bid/15373

In short, there is a perl regexp that crashes if spamassassin tries to
pass an email with thousands of addressess in it.

They refer to the spamassassin bugzilla:
http://issues.apache.org/SpamAssassin/show_bug.cgi?id=4570

In that bugzilla entry someone suggested this patch:
http://issues.apache.org/SpamAssassin/attachment.cgi?id=3121

And the end of the bugzilla report it says that the fix was committed with 331942.

--
Geoff Crompton

Message #20 received at 339526@bugs.debian.org (full text, mbox, reply):

From: Jonas Smedegaard <dr@jones.dk>

To: 339526-submitter@bugs.debian.org

Cc: 339526@bugs.debian.org

Subject: This bug has been fixed in later releases packaged for Etch and Sid.

Date: Sat, 24 Dec 2005 07:03:17 +0100

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

As subject says (but some BTS interfaces don't show subject so I
repeat here), this bug has been fixed in later releases packaged for
Etch and Sid.

So I have marked this bug as sarge, fixed-upstream and closed in
3.1.0a-1.


 - Jonas

- -- 
* Jonas Smedegaard - idealist og Internet-arkitekt
* Tlf.: +45 40843136  Website: http://dr.jones.dk/

 - Enden er nær: http://www.shibumi.org/eoti.htm
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2 (GNU/Linux)

iD8DBQFDrOSln7DbMsAkQLgRAoKFAJ4hbh9/oUtKb6LU1fQb5nUh9+z0MgCfTrFb
wMSmkXJ+w15SkLGFCKFcURE=
=VcS7
-----END PGP SIGNATURE-----

Message #34 received at 339526@bugs.debian.org (full text, mbox, reply):

From: Don Armstrong <don@debian.org>

To: 339526@bugs.debian.org, team@security.debian.org

Subject: Patch to fix 339526 and CVE-2005-3351

Date: Tue, 3 Jan 2006 07:15:29 -0800

[Message part 1 (text/plain, inline)]

tag 339526 patch
thanks

spamassassin (3.0.3-2sarge0) stable-security; urgency=high

  * Fix a potential bypass of spam detection when insanely large To:
    headers are encountered. (CVE-2005-3351) (Closes: #339526)

 -- Don Armstrong <don@debian.org>  Tue,  3 Jan 2006 07:01:02 -0800


svn diff -r261908:279666 http://svn.apache.org/repos/asf/spamassassin/trunk/lib/Mail/SpamAssassin/Message.pm

has the exact diff from upstream; patch attached.


Don Armstrong

-- 
We were at a chinese resturant.
He was yelling at the waitress because there was a typo in his fortune
cookie.
 -- hugh macleod http://www.gapingvoid.com/batch41.php

http://www.donarmstrong.com              http://rzlab.ucr.edu

[security_339562.diff (text/plain, attachment)]

[signature.asc (application/pgp-signature, inline)]

Message #41 received at 339526@bugs.debian.org (full text, mbox, reply):

From: Duncan Findlay <duncf@debian.org>

To: Don Armstrong <don@debian.org>, 339526@bugs.debian.org

Cc: team@security.debian.org

Subject: Re: Bug#339526: Patch to fix 339526 and CVE-2005-3351

Date: Tue, 3 Jan 2006 18:43:12 -0500

[Message part 1 (text/plain, inline)]

I sent a fixed package to the security team yesterday. As far as
"security" bugs go, the impact of this one is as minimal as
possible. Sure, it's a segfault, but we don't believe it's
exploitable, it can't really be used to launch a DoS. Spammers can use
it to force one message through, but not take down spamd, AFAIK.

-- 
Duncan Findlay

[signature.asc (application/pgp-signature, inline)]

Message #46 received at 339526-done@bugs.debian.org (full text, mbox, reply):

From: Pierre HABOUZIT <madcoder@debian.org>

To: Duncan Findlay <duncf@debian.org>, 339526-done@bugs.debian.org

Subject: Re: reopening 339526, found 339526 in 3.0.3-2, notfound 339526 in 3.1.0a-1

Date: Thu, 25 May 2006 15:38:34 +0200

[Message part 1 (text/plain, inline)]

Version: 3.1.0a-1

  this bug does not concern etch/sid. closing bug for those versions.

-- 
·O·  Pierre Habouzit
··O                                                madcoder@debian.org
OOO                                                http://www.madism.org

[signature.asc (application/pgp-signature, inline)]

Send a report that this bug log contains spam.