bugtraq - [ MDKSA-2007:125 ] - Updated spamassassin packages fix possible DoS condition

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-id: <E1Hyvqg-0005A4-3W@artemis.annvix.ca>
Date: Thu, 14 Jun 2007 14:23:18 -0600
From: security@...driva.com
To: bugtraq@...urityfocus.com
Subject: [ MDKSA-2007:125 ] - Updated spamassassin packages fix possible DoS
 condition


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________
 
 Mandriva Linux Security Advisory                         MDKSA-2007:125
 http://www.mandriva.com/security/
 _______________________________________________________________________
 
 Package : spamassassin
 Date    : June 14, 2007
 Affected: 2007.0, 2007.1, Corporate 4.0
 _______________________________________________________________________
 
 Problem Description:
 
 SpamAssassin 3.1.x, when running as root with unusual configuration
 options using vpopmail or virtual users, could allow local users to
 cause a denial of service (via corrupting arbitrary files) using a
 symlink attack on a file used by spamd.
 
 SpamAssassin 3.1.9, which corrects this flaw, is provided with
 this update.
 _______________________________________________________________________

 References:
 
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2873
 http://spamassassin.apache.org/advisories/cve-2007-2873.txt
 _______________________________________________________________________
 
 Updated Packages:
 
 Mandriva Linux 2007.0:
 6868ff1682b0af4f4a1496d1b17b1abb  2007.0/i586/perl-Mail-SpamAssassin-3.1.9-0.1mdv2007.0.i586.rpm
 1cedda8aa0bd35a0e745180a45a19979  2007.0/i586/spamassassin-3.1.9-0.1mdv2007.0.i586.rpm
 00cffd46beb7733d24a7194e7a269f59  2007.0/i586/spamassassin-spamc-3.1.9-0.1mdv2007.0.i586.rpm
 97a3c6aebaf515c2d07ae903e3ade97b  2007.0/i586/spamassassin-spamd-3.1.9-0.1mdv2007.0.i586.rpm
 2d17ea30dbc1679f0770415a4f1e93bc  2007.0/i586/spamassassin-tools-3.1.9-0.1mdv2007.0.i586.rpm 
 5cd9896b49fed9eb8fc774167d74244c  2007.0/SRPMS/spamassassin-3.1.9-0.1mdv2007.0.src.rpm

 Mandriva Linux 2007.0/X86_64:
 136b4b7726af7e858bdfd416a590bc69  2007.0/x86_64/perl-Mail-SpamAssassin-3.1.9-0.1mdv2007.0.x86_64.rpm
 d9e416f10cfc5ea29cc6f5fe683b5dda  2007.0/x86_64/spamassassin-3.1.9-0.1mdv2007.0.x86_64.rpm
 7abe66bb43c8dd00cad3759664c6bf65  2007.0/x86_64/spamassassin-spamc-3.1.9-0.1mdv2007.0.x86_64.rpm
 5ea0a2c56eb2ac07df39ec1a578ce385  2007.0/x86_64/spamassassin-spamd-3.1.9-0.1mdv2007.0.x86_64.rpm
 ef19bf0d92d5ba5191669bad149c78c5  2007.0/x86_64/spamassassin-tools-3.1.9-0.1mdv2007.0.x86_64.rpm 
 5cd9896b49fed9eb8fc774167d74244c  2007.0/SRPMS/spamassassin-3.1.9-0.1mdv2007.0.src.rpm

 Mandriva Linux 2007.1:
 c346bacaf0032d8b04c7d8d0fd3d5e58  2007.1/i586/perl-Mail-SpamAssassin-3.1.9-0.1mdv2007.1.i586.rpm
 bcf67361bf441a9e3b3783d0f3802449  2007.1/i586/spamassassin-3.1.9-0.1mdv2007.1.i586.rpm
 524d9f34a21b63bd60e23f9e3b10ab72  2007.1/i586/spamassassin-spamc-3.1.9-0.1mdv2007.1.i586.rpm
 4d15df1d52591e597b504801e3b48fa9  2007.1/i586/spamassassin-spamd-3.1.9-0.1mdv2007.1.i586.rpm
 7d5394511014e74ec8f1407820fd0646  2007.1/i586/spamassassin-tools-3.1.9-0.1mdv2007.1.i586.rpm 
 b261e57f3a15bd6f2c0b1d1fe731723d  2007.1/SRPMS/spamassassin-3.1.9-0.1mdv2007.1.src.rpm

 Mandriva Linux 2007.1/X86_64:
 92b56f81d9602aa7c78799a368f5a227  2007.1/x86_64/perl-Mail-SpamAssassin-3.1.9-0.1mdv2007.1.x86_64.rpm
 63d5278e935c222cc07ce10f25921a01  2007.1/x86_64/spamassassin-3.1.9-0.1mdv2007.1.x86_64.rpm
 c461b6faf2a7c6283d8380e9ff45c66f  2007.1/x86_64/spamassassin-spamc-3.1.9-0.1mdv2007.1.x86_64.rpm
 ea4ec4e59e5f7589bed9463fbcf09ccb  2007.1/x86_64/spamassassin-spamd-3.1.9-0.1mdv2007.1.x86_64.rpm
 eab7972520d2ff2dae31eb3facae2caa  2007.1/x86_64/spamassassin-tools-3.1.9-0.1mdv2007.1.x86_64.rpm 
 b261e57f3a15bd6f2c0b1d1fe731723d  2007.1/SRPMS/spamassassin-3.1.9-0.1mdv2007.1.src.rpm

 Corporate 4.0:
 91fe3692a86bc63d73b2cd65b9a7680d  corporate/4.0/i586/perl-Mail-SpamAssassin-3.1.9-0.1.20060mlcs4.i586.rpm
 576704ea8dc89097e611c5ffaf1e604f  corporate/4.0/i586/spamassassin-3.1.9-0.1.20060mlcs4.i586.rpm
 47fef4374240c6c6f7c475b675e620ee  corporate/4.0/i586/spamassassin-spamc-3.1.9-0.1.20060mlcs4.i586.rpm
 c10a0adc7e9c1a0d4ee7ae7ca981fefc  corporate/4.0/i586/spamassassin-spamd-3.1.9-0.1.20060mlcs4.i586.rpm
 f1d5308b7bcce9eed20028623b98fa02  corporate/4.0/i586/spamassassin-tools-3.1.9-0.1.20060mlcs4.i586.rpm 
 e05b3f4264eccec4af0204b2d86009e0  corporate/4.0/SRPMS/spamassassin-3.1.9-0.1.20060mlcs4.src.rpm

 Corporate 4.0/X86_64:
 ee0e50378b04981186e363e9ffd46a0c  corporate/4.0/x86_64/perl-Mail-SpamAssassin-3.1.9-0.1.20060mlcs4.x86_64.rpm
 deb4f200369c92ece52b62dd40485ec1  corporate/4.0/x86_64/spamassassin-3.1.9-0.1.20060mlcs4.x86_64.rpm
 bef27fbaf42eea12e584a0ebca872b77  corporate/4.0/x86_64/spamassassin-spamc-3.1.9-0.1.20060mlcs4.x86_64.rpm
 ed5b1d4c8e9c65dbe47e3c52d98928f5  corporate/4.0/x86_64/spamassassin-spamd-3.1.9-0.1.20060mlcs4.x86_64.rpm
 287bde6ce88bb820d788e0017b19d39b  corporate/4.0/x86_64/spamassassin-tools-3.1.9-0.1.20060mlcs4.x86_64.rpm 
 e05b3f4264eccec4af0204b2d86009e0  corporate/4.0/SRPMS/spamassassin-3.1.9-0.1.20060mlcs4.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrivaUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandriva for security.  You can obtain the
 GPG public key of the Mandriva Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandriva Linux at:

  http://www.mandriva.com/security/advisories

 If you want to report vulnerabilities, please contact

  security_(at)_mandriva.com
 _______________________________________________________________________

 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Mandriva Security Team
  <security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (GNU/Linux)

iD8DBQFGcXj+mqjQ0CJFipgRArukAJ41azTr7OCDXVE8pIbFeEMSYpWvYQCdFDv4
B2jtwebSsYZyCH2GIReV+lc=
=NOIn
-----END PGP SIGNATURE-----