Vulnerabilities > CVE-2018-11781 - Code Injection vulnerability in multiple products
Attack vector
LOCAL Attack complexity
LOW Privileges required
LOW Confidentiality impact
HIGH Integrity impact
HIGH Availability impact
HIGH Summary
Apache SpamAssassin 3.4.2 fixes a local user code injection in the meta rule syntax.
Vulnerable Configurations
Common Weakness Enumeration (CWE)
Common Attack Pattern Enumeration and Classification (CAPEC)
- Leverage Executable Code in Non-Executable Files An attack of this type exploits a system's trust in configuration and resource files, when the executable loads the resource (such as an image file or configuration file) the attacker has modified the file to either execute malicious code directly or manipulate the target process (e.g. application server) to execute based on the malicious configuration parameters. Since systems are increasingly interrelated mashing up resources from local and remote sources the possibility of this attack occurring is high. The attack can be directed at a client system, such as causing buffer overrun through loading seemingly benign image files, as in Microsoft Security Bulletin MS04-028 where specially crafted JPEG files could cause a buffer overrun once loaded into the browser. Another example targets clients reading pdf files. In this case the attacker simply appends javascript to the end of a legitimate url for a pdf (http://www.gnucitizen.org/blog/danger-danger-danger/) http://path/to/pdf/file.pdf#whatever_name_you_want=javascript:your_code_here The client assumes that they are reading a pdf, but the attacker has modified the resource and loaded executable javascript into the client's browser process. The attack can also target server processes. The attacker edits the resource or configuration file, for example a web.xml file used to configure security permissions for a J2EE app server, adding role name "public" grants all users with the public role the ability to use the administration functionality. The server trusts its configuration file to be correct, but when they are manipulated, the attacker gains full control.
- Manipulating User-Controlled Variables This attack targets user controlled variables (DEBUG=1, PHP Globals, and So Forth). An attacker can override environment variables leveraging user-supplied, untrusted query variables directly used on the application server without any data sanitization. In extreme cases, the attacker can change variables controlling the business logic of the application. For instance, in languages like PHP, a number of poorly set default configurations may allow the user to override variables.
Nessus
NASL family Amazon Linux Local Security Checks NASL id AL2_ALAS-2018-1103.NASL description A flaw was found in the way SpamAssassin processes HTML email containing unclosed HTML tags. A carefully crafted mail message could cause SpamAssassin to consume significant resources. If a large number of these messages are sent, a denial of service could occur potentially delaying or preventing the delivery of email.(CVE-2017-15705) A flaw was found in the way a local user on the SpamAssassin server could inject code in the meta rule syntax. This could cause the arbitrary code execution on the server when these rules are being processed.(CVE-2018-11781) last seen 2020-06-01 modified 2020-06-02 plugin id 118834 published 2018-11-09 reporter This script is Copyright (C) 2018 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/118834 title Amazon Linux 2 : spamassassin (ALAS-2018-1103) NASL family Oracle Linux Local Security Checks NASL id ORACLELINUX_ELSA-2018-2916.NASL description From Red Hat Security Advisory 2018:2916 : An update for spamassassin is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. The SpamAssassin tool provides a way to reduce unsolicited commercial email (spam) from incoming email. Security Fix(es) : * spamassassin: Certain unclosed tags in crafted emails allow for scan timeouts and result in denial of service (CVE-2017-15705) * spamassassin: Local user code injection in the meta rule syntax (CVE-2018-11781) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section. last seen 2020-06-01 modified 2020-06-02 plugin id 118076 published 2018-10-12 reporter This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/118076 title Oracle Linux 7 : spamassassin (ELSA-2018-2916) NASL family FreeBSD Local Security Checks NASL id FREEBSD_PKG_613193A0C1B411E8AE2D54E1AD3D6335.NASL description the Apache Spamassassin project reports : In Apache SpamAssassin, using HTML::Parser, we setup an object and hook into the begin and end tag event handlers In both cases, the last seen 2020-06-01 modified 2020-06-02 plugin id 117721 published 2018-09-27 reporter This script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/117721 title FreeBSD : spamassassin -- multiple vulnerabilities (613193a0-c1b4-11e8-ae2d-54e1ad3d6335) NASL family SuSE Local Security Checks NASL id OPENSUSE-2019-1831.NASL description This update for spamassassin to version 3.4.2 fixes the following issues : Security issues fixed : - CVE-2018-11781: Fixed an issue where a local user could inject code in the meta rule syntax (bsc#1108748). - CVE-2018-11780: Fixed a potential remote code execution vulnerability in the PDFInfo plugin (bsc#1108750). - CVE-2017-15705: Fixed a denial of service through unclosed tags in crafted emails (bsc#1108745). - CVE-2016-1238: Fixed an issue where perl would load modules from the current directory (bsc#1108749). Non-security issues fixed : - Use systemd timers instead of cron (bsc#1115411) - Fixed incompatibility with Net::DNS >= 1.01 (bsc#1107765) - Fixed warning about deprecated regex during sa-update (bsc#1069831) This update was imported from the SUSE:SLE-15:Update update project. last seen 2020-06-01 modified 2020-06-02 plugin id 127739 published 2019-08-12 reporter This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/127739 title openSUSE Security Update : spamassassin (openSUSE-2019-1831) NASL family Fedora Local Security Checks NASL id FEDORA_2018-6ED251C42B.NASL description Fixed some small bugs in the previous package: Initial rules now have the correct version, sought channel config is dropped (since it doesn last seen 2020-06-05 modified 2018-10-01 plugin id 117840 published 2018-10-01 reporter This script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/117840 title Fedora 27 : spamassassin (2018-6ed251c42b) NASL family Debian Local Security Checks NASL id DEBIAN_DLA-1578.NASL description Multiple vulnerabilities were found in Spamassassin, which could lead to Remote Code Execution and Denial of Service attacks under certain circumstances. CVE-2016-1238 Many Perl programs do not properly remove . (period) characters from the end of the includes directory array, which might allow local users to gain privileges via a Trojan horse module under the current working directory. CVE-2017-15705 A denial of service vulnerability was identified that exists in Apache SpamAssassin before 3.4.2. The vulnerability arises with certain unclosed tags in emails that cause markup to be handled incorrectly leading to scan timeouts. This can cause carefully crafted emails that might take more scan time than expected leading to a Denial of Service. CVE-2018-11780 A potential Remote Code Execution bug exists with the PDFInfo plugin in Apache SpamAssassin before 3.4.2. CVE-2018-11781 Apache SpamAssassin 3.4.2 fixes a local user code injection in the meta rule syntax. For Debian 8 last seen 2020-06-01 modified 2020-06-02 plugin id 118938 published 2018-11-14 reporter This script is Copyright (C) 2018 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/118938 title Debian DLA-1578-1 : spamassassin security update NASL family SuSE Local Security Checks NASL id SUSE_SU-2019-2011-1.NASL description This update for spamassassin to version 3.4.2 fixes the following issues : Security issues fixed : CVE-2018-11781: Fixed an issue where a local user could inject code in the meta rule syntax (bsc#1108748). CVE-2018-11780: Fixed a potential remote code execution vulnerability in the PDFInfo plugin (bsc#1108750). CVE-2017-15705: Fixed a denial of service through unclosed tags in crafted emails (bsc#1108745). CVE-2016-1238: Fixed an issue where perl would load modules from the current directory (bsc#1108749). Non-security issues fixed: Use systemd timers instead of cron (bsc#1115411) Fixed incompatibility with Net::DNS >= 1.01 (bsc#1107765) Fixed warning about deprecated regex during sa-update (bsc#1069831) Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 127751 published 2019-08-12 reporter This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/127751 title SUSE SLED15 / SLES15 Security Update : spamassassin (SUSE-SU-2019:2011-1) NASL family NewStart CGSL Local Security Checks NASL id NEWSTART_CGSL_NS-SA-2019-0041_SPAMASSASSIN.NASL description The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has spamassassin packages installed that are affected by multiple vulnerabilities: - A flaw was found in the way a local user on the SpamAssassin server could inject code in the meta rule syntax. This could cause the arbitrary code execution on the server when these rules are being processed. (CVE-2018-11781) - A flaw was found in the way SpamAssassin processes HTML email containing unclosed HTML tags. A carefully crafted mail message could cause SpamAssassin to consume significant resources. If a large number of these messages are sent, a denial of service could occur potentially delaying or preventing the delivery of email. (CVE-2017-15705) Note that Nessus has not tested for this issue but has instead relied only on the application last seen 2020-06-01 modified 2020-06-02 plugin id 127217 published 2019-08-12 reporter This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/127217 title NewStart CGSL CORE 5.04 / MAIN 5.04 : spamassassin Multiple Vulnerabilities (NS-SA-2019-0041) NASL family SuSE Local Security Checks NASL id SUSE_SU-2019-1961-1.NASL description This update for spamassassin to version 3.4.2 fixes the following issues : Security issues fixed : CVE-2017-15705: Fixed denial of service via unclosed tags in crafted emails (bsc#1108745). CVE-2018-11781: Fixed a code injection in the meta rule syntax by local users (bsc#1108748). CVE-2018-11780: Fixed a potential remote code execution vulnerability in PDFInfo plugin (bsc#1108750). Non-security issues fixed: Added four new plugins (disabled by default): HashBL, ResourceLimits, FromNameSpoof, Phishing sa-update script: optional support for SHA-256 / SHA-512 been added for better validation of rules GeoIP2 support has been added to RelayCountry and URILocalBL plugins Several new or enhanced configuration options Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 127038 published 2019-07-25 reporter This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/127038 title SUSE SLED12 / SLES12 Security Update : spamassassin (SUSE-SU-2019:1961-1) NASL family Scientific Linux Local Security Checks NASL id SL_20181011_SPAMASSASSIN_ON_SL7_X.NASL description Security Fix(es) : - spamassassin: Certain unclosed tags in crafted emails allow for scan timeouts and result in denial of service (CVE-2017-15705) - spamassassin: Local user code injection in the meta rule syntax (CVE-2018-11781) last seen 2020-03-18 modified 2018-10-15 plugin id 118108 published 2018-10-15 reporter This script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/118108 title Scientific Linux Security Update : spamassassin on SL7.x x86_64 (20181011) NASL family Amazon Linux Local Security Checks NASL id ALA_ALAS-2018-1091.NASL description A flaw was found in the way a local user on the SpamAssassin server could inject code in the meta rule syntax. This could cause the arbitrary code execution on the server when these rules are being processed.(CVE-2018-11781) A potential Remote Code Execution bug exists with the PDFInfo plugin in Apache SpamAssassin before 3.4.2.(CVE-2018-11780) A flaw was found in the way SpamAssassin processes HTML email containing unclosed HTML tags. A carefully crafted mail message could cause SpamAssassin to consume significant resources. If a large number of these messages are sent, a denial of service could occur potentially delaying or preventing the delivery of email.(CVE-2017-15705) last seen 2020-06-01 modified 2020-06-02 plugin id 118211 published 2018-10-19 reporter This script is Copyright (C) 2018 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/118211 title Amazon Linux AMI : spamassassin (ALAS-2018-1091) NASL family Ubuntu Local Security Checks NASL id UBUNTU_USN-3811-1.NASL description It was discovered that SpamAssassin incorrectly handled certain unclosed tags in emails. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2017-15705) It was discovered that SpamAssassin incorrectly handled the PDFInfo plugin. A remote attacker could possibly use this issue to execute arbitrary code. (CVE-2018-11780) It was discovered that SpamAssassin incorrectly handled meta rule syntax. A local attacker could possibly use this issue to execute arbitrary code. (CVE-2018-11781). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 118797 published 2018-11-07 reporter Ubuntu Security Notice (C) 2018-2019 Canonical, Inc. / NASL script (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/118797 title Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS : spamassassin vulnerabilities (USN-3811-1) NASL family Gentoo Local Security Checks NASL id GENTOO_GLSA-201812-07.NASL description The remote host is affected by the vulnerability described in GLSA-201812-07 (SpamAssassin: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in SpamAssassin. Please review the referenced CVE identifiers for details. Impact : A remote attacker could execute arbitrary code, escalate privileges, or cause a Denial of Service condition. Workaround : There is no known workaround at this time. last seen 2020-03-28 modified 2018-12-17 plugin id 119703 published 2018-12-17 reporter This script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/119703 title GLSA-201812-07 : SpamAssassin: Multiple vulnerabilities NASL family CentOS Local Security Checks NASL id CENTOS_RHSA-2018-2916.NASL description An update for spamassassin is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. The SpamAssassin tool provides a way to reduce unsolicited commercial email (spam) from incoming email. Security Fix(es) : * spamassassin: Certain unclosed tags in crafted emails allow for scan timeouts and result in denial of service (CVE-2017-15705) * spamassassin: Local user code injection in the meta rule syntax (CVE-2018-11781) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section. last seen 2020-06-01 modified 2020-06-02 plugin id 118117 published 2018-10-16 reporter This script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/118117 title CentOS 7 : spamassassin (CESA-2018:2916) NASL family Red Hat Local Security Checks NASL id REDHAT-RHSA-2018-2916.NASL description An update for spamassassin is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. The SpamAssassin tool provides a way to reduce unsolicited commercial email (spam) from incoming email. Security Fix(es) : * spamassassin: Certain unclosed tags in crafted emails allow for scan timeouts and result in denial of service (CVE-2017-15705) * spamassassin: Local user code injection in the meta rule syntax (CVE-2018-11781) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section. last seen 2020-06-01 modified 2020-06-02 plugin id 118077 published 2018-10-12 reporter This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/118077 title RHEL 7 : spamassassin (RHSA-2018:2916) NASL family Fedora Local Security Checks NASL id FEDORA_2018-8F0DF2C366.NASL description Fixed some small bugs in the previous package: Initial rules now have the correct version, sought channel config is dropped (since it doesn last seen 2020-06-05 modified 2019-01-03 plugin id 120609 published 2019-01-03 reporter This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/120609 title Fedora 29 : spamassassin (2018-8f0df2c366) NASL family Fedora Local Security Checks NASL id FEDORA_2018-46D7A7F63E.NASL description Fixed some small bugs in the previous package: Initial rules now have the correct version, sought channel config is dropped (since it doesn last seen 2020-06-05 modified 2019-01-03 plugin id 120387 published 2019-01-03 reporter This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/120387 title Fedora 28 : spamassassin (2018-46d7a7f63e)
Redhat
advisories |
| ||||||||||||||||||||||||||||||||||||||
rpms |
|
References
- https://access.redhat.com/errata/RHSA-2018:2916
- https://usn.ubuntu.com/3811-1/
- https://lists.debian.org/debian-lts-announce/2018/11/msg00016.html
- https://usn.ubuntu.com/3811-3/
- https://security.gentoo.org/glsa/201812-07
- http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00002.html
- https://lists.apache.org/thread.html/7f6a16bc0fd0fd5e67c7fd95bd655069a2ac7d1f88e42d3c853e601c%40%3Cannounce.apache.org%3E