Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2018.3550 [DLA 1578-1] spamassassin security update 14 November 2018 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: spamassassin Publisher: Debian Operating System: Debian GNU/Linux 8 Impact/Access: Execute Arbitrary Code/Commands -- Remote/Unauthenticated Denial of Service -- Remote/Unauthenticated Resolution: Patch/Upgrade CVE Names: CVE-2018-11781 CVE-2018-11780 CVE-2017-15705 CVE-2016-1238 Reference: ESB-2018.3479 Original Bulletin: https://lists.debian.org/debian-lts-announce/2018/11/msg00016.html - --------------------------BEGIN INCLUDED TEXT-------------------- Package : spamassassin Version : 3.4.2-0+deb8u1 CVE ID : CVE-2016-1238 CVE-2017-15705 CVE-2018-11780 CVE-2018-11781 Debian Bug : 784023 865924 883775 889501 891041 908969 908970 908971 913571 Multiple vulnerabilities were found in Spamassassin, which could lead to Remote Code Execution and Denial of Service attacks under certain circumstances. CVE-2016-1238 Many Perl programs do not properly remove . (period) characters from the end of the includes directory array, which might allow local users to gain privileges via a Trojan horse module under the current working directory. CVE-2017-15705 A denial of service vulnerability was identified that exists in Apache SpamAssassin before 3.4.2. The vulnerability arises with certain unclosed tags in emails that cause markup to be handled incorrectly leading to scan timeouts. This can cause carefully crafted emails that might take more scan time than expected leading to a Denial of Service. CVE-2018-11780 A potential Remote Code Execution bug exists with the PDFInfo plugin in Apache SpamAssassin before 3.4.2. CVE-2018-11781 Apache SpamAssassin 3.4.2 fixes a local user code injection in the meta rule syntax. For Debian 8 "Jessie", these problems have been fixed in version 3.4.2-0+deb8u1. Upstream strongly advocates upgrading to the latest upstream version so we are following that recommendation and backported the version published as part of the 9.6 stretch release, which also fixes many critical bugs. We recommend that you upgrade your spamassassin packages. Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS - --------------------------END INCLUDED TEXT-------------------- You have received this e-mail bulletin as a result of your organisation's registration with AusCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to auscert@auscert.org.au and we will forward your request to the appropriate person. NOTE: Third Party Rights This security bulletin is provided as a service to AusCERT's members. As AusCERT did not write the document quoted above, AusCERT has had no control over its content. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the author's website to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: https://www.auscert.org.au/bulletins/ =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: http://www.auscert.org.au/render.html?it=1967 iQIVAwUBW+t0Q2aOgq3Tt24GAQjVQhAAp4mTzRa2CCE6iPXNrXFHSPEnPn46E22z PIYCyCmg8KGeZF/et/5KwUS/YMqqi6FdEc0vyGI6wsirEdJO4mzpEWmVAg214fpm coAzUj8kk9rSYqXVvxfupa4Vu9/3Nj5VXxJaHzVXuY+7iweZvL1oju8892W805JX MF/Skvp1JpuEWBkVCKk0NGTENA5tVlVD848GeLIaNzQzqMaBASkiBs6Y/Gq3UXsm hxNtbahnp8nKSQtz3t0UnmYD7YKfq+O6UM9Ive3dFXSvg2CBAaHJJjgUG60jtzdO 9T6F+hsM5n9Sa9hcb0CuoJvXshsmaHOk9FW/wNvxxWPeD2SbT7TTX1I2zfDPYY1c glI0Mc4yCk40A2hGUorZPXBjws1eOSZpuTJLIO57dxhR53gzoLhDoQXhQ0909vnS vEFQB98t0niZH69vyCrm8KEPIZIZlY1jO4jd8Z6884v3kcQfLp8qZMoqO6xC6nQo QbjNxW8rgbAKsJmTc5b7vrrDrLXBtEoYDPv3WDzdTfLtPr/xoHVbSK2pwBjZPb52 1elqwKxtHumhAL2nga+mAD0enZICSJcSPbR36UBmwa2LsLM716ti9Q1+LRu5DNby V/i2+kOx/4w1CoyYRgTBzot0KTtjM30SA2jISLJwNK5DFtuMg2gzTEtF+/8Rzo5f BRs4CeyyDvk= =X/I6 -----END PGP SIGNATURE-----