Red Hat セキュリティアドバイザリ 2007:0074 から：

1 件のセキュリティ問題を修正する更新済みの spamassassin パッケージが、Red Hat Enterprise Linux 4 で現在利用可能です。

Red Hat セキュリティレスポンスチームは、この更新に重大なセキュリティインパクトがあると評価しています。

SpamAssassin は、受信メールから商業的な迷惑メール（スパム）を減らす手段を提供します。

SpamAssassin が URI を含む HTML メールを処理する方法で欠陥が見つかりました。注意深く細工されたメールメッセージによって、SpamAssassin が大量のリソースを消費する可能性があります。これらのメッセージが大量に送信された場合、サービス拒否につながり、メールの配信の遅延または阻止が発生する可能性があります。(CVE-2007-0451)

SpamAssassin のユーザーは、これらの問題に対して脆弱でないバージョン 3.1.8 が含まれるこれらの更新済みパッケージへアップグレードする必要があります。

これは SpamAssassin バージョン 3.0.6 から 3.1.8 へのアップグレードで、多数のバグ修正およびスパム検出強化が含まれます。詳細は、SpamAssassin 3.1 変更ログおよびアップグレードガイドで現在利用可能です。

This upgrades to version 3.1.8, which fixes some bugs and CVE-2007-0451 Malformed HTML Denial of Service.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This upgrade brings spamassassin to version 3.1.8 with following changes :

  - fix for CVE-2007-0451: possible DoS due to incredibly     long URIs found in the message content.

  - disable perl module usage in update channels unless

    -allowplugins is specified

  - files with names starting/ending in whitespace weren't     usable

  - remove Text::Wrap related code due to upstream issues

  - update spamassassin and sa-learn to better deal with     STDIN

  - improvements and bug fixes related to DomainKeys and     DKIM support

  - several updates for Received header parsing

  - several documentation updates and random taint-variable     related issues

This update also adds some missing dependencies.

来自 Red Hat 安全公告 2007:0074：

更新后的 spamassassin 程序包修复了一个安全问题，现在可用于 Red Hat Enterprise Linux 4。

Red Hat 安全响应团队将此更新评级为具有重要安全影响。

SpamAssassin 可用于减少收到的来路不明的商业电子邮件（垃圾邮件）。

在 SpamAssassin 处理包含 URI 的 HTML 电子邮件的方式中发现了一个缺陷。精心构建的电子邮件消息可造成 SpamAssassin 耗用大量资源。如果发送大量这些消息，可导致拒绝服务，可能延迟或阻止电子邮件的传递。(CVE-2007-0451)

SpamAssassin 用户应升级这些更新后的程序包，其中包含不受这些问题影响的版本 3.1.8。

这是从 SpamAssassin 版本 3.0.6 到 3.1.8 的升级，升级后的版本包含许多缺陷补丁和垃圾邮件检测增强。更多详细信息请参阅 SpamAssassin 3.1 变更日志和升级指南。

來自 Red Hat 安全性公告 2007:0074：

現已提供適用於 Red Hat Enterprise Linux 4 的更新版 spamassassin 套件，可修正一個安全性問題。

Red Hat 安全性回應團隊已將此更新評等為具有重要安全性影響。

SpamAssassin 提供了一個可盡量避免內送電子郵件收到來路不明商業電子郵件 (垃圾郵件) 的方法。

在 SpamAssassin 處理含有 URI 之 HTML 電子郵件的方式中發現一個瑕疵。特製的郵件訊息可導致 SpamAssassin 消耗大量資源。若傳送一些這類訊息，便會導致拒絕服務，進而可能造成延遲或阻止電子郵件的遞送。(CVE-2007-0451)

SpamAssassin 使用者應升級至這些更新版套件，其中包含不會受到這些問題影響的 3.1.8 版。

這是從 SpamAssassin 3.0.6 到 3.1.8 版的升級，其中包含許多錯誤修正和垃圾郵件偵測增強功能。進一步的詳細資料可在 SpamAssassin 3.1 變更記錄和升級指南中取得。

Updated spamassassin packages that fix a security issue are now available for Red Hat Enterprise Linux 4.

This update has been rated as having important security impact by the Red Hat Security Response Team.

SpamAssassin provides a way to reduce unsolicited commercial email (spam) from incoming email.

A flaw was found in the way SpamAssassin processes HTML email containing URIs. A carefully crafted mail message could cause SpamAssassin to consume significant resources. If a number of these messages are sent, this could lead to a denial of service, potentially delaying or preventing the delivery of email. (CVE-2007-0451)

Users of SpamAssassin should upgrade to these updated packages which contain version 3.1.8 which is not vulnerable to these issues.

This is an upgrade from SpamAssassin version 3.0.6 to 3.1.8, which contains many bug fixes and spam detection enhancements. Further details are available in the SpamAssassin 3.1 changelog and upgrade guide.

This upgrade brings spamassassin to version 3.1.8 with following changes :

  - fix for CVE-2007-0451: possible DoS due to incredibly     long URIs found in the message content.

  - disable perl module usage in update channels unless

    --allowplugins is specified

  - files with names starting/ending in whitespace weren't     usable

  - remove Text::Wrap related code due to upstream issues

  - update spamassassin and sa-learn to better deal with     STDIN

  - improvements and bug fixes related to DomainKeys and     DKIM support

  - several updates for Received header parsing

  - several documentation updates and random taint-variable     related issues

This update also adds some missing dependencies.

The remote host is affected by the vulnerability described in GLSA-200703-02 (SpamAssassin: Long URI Denial of Service)

    SpamAssassin does not correctly handle very long URIs when scanning     emails.
  Impact :

    An attacker could cause SpamAssassin to consume large amounts of CPU     and memory resources by sending one or more emails containing very long     URIs.
  Workaround :

    There is no known workaround at this time.

Updated spamassassin packages that fix a security issue are now available for Red Hat Enterprise Linux 5.

This update has been rated as having important security impact by the Red Hat Security Response Team.

SpamAssassin provides a way to reduce unsolicited commercial email (spam) from incoming email.

A flaw was found in the way SpamAssassin processes HTML email containing URIs. A carefully crafted mail message could cause SpamAssassin to consume significant resources. If a number of these messages are sent, this could lead to a denial of service, potentially delaying or preventing the delivery of email. (CVE-2007-0451)

Users of SpamAssassin should upgrade to these updated packages which contain version 3.1.8 which is not vulnerable to these issues.

A bug in the way that SpamAssassin processes HTML emails containing URIs was discovered in versions 3.1.x. A carefully crafted mail message could make SpamAssassin consume significant amounts of CPU resources that could delay or prevent the delivery of mail if a number of these messages were sent at once.

SpamAssassin has been upgraded to version 3.1.8 to correct this problem, and other upstream bugs. In addition, an invalid path setting in local.cf for the auto_whitelist_path has been fixed for Mandriva 2007.0.

From Red Hat Security Advisory 2007:0074 :

Updated spamassassin packages that fix a security issue are now available for Red Hat Enterprise Linux 4.

This update has been rated as having important security impact by the Red Hat Security Response Team.

SpamAssassin provides a way to reduce unsolicited commercial email (spam) from incoming email.

A flaw was found in the way SpamAssassin processes HTML email containing URIs. A carefully crafted mail message could cause SpamAssassin to consume significant resources. If a number of these messages are sent, this could lead to a denial of service, potentially delaying or preventing the delivery of email. (CVE-2007-0451)

Users of SpamAssassin should upgrade to these updated packages which contain version 3.1.8 which is not vulnerable to these issues.

This is an upgrade from SpamAssassin version 3.0.6 to 3.1.8, which contains many bug fixes and spam detection enhancements. Further details are available in the SpamAssassin 3.1 changelog and upgrade guide.

The remote host is running SpamAssassin, an anti-spam software application that detects and blocks spam emails.  Due to a content-parsing error, SpamAssassin can be crashed when processing very long URIs within an email message.  An attacker exploiting this flaw would only need to have the ability to craft and send an email.  Successful exploitation leads to a loss of availability.

ID	名稱	產品	系列	已發布	已更新	嚴重性
67450	Oracle Linux 4：spamassassin（ELSA-2007-0074）	Nessus	Oracle Linux Local Security Checks	2013/7/12	2021/1/14	medium
24361	Fedora Core 5 : spamassassin-3.1.8-1.fc5 (2007-242)	Nessus	Fedora Local Security Checks	2007/2/17	2021/1/11	medium
29581	SuSE 10 Security Update : SPAMAssassin (ZYPP Patch Number 3078)	Nessus	SuSE Local Security Checks	2007/12/13	2021/1/14	medium
67450	Oracle Linux 4：spamassassin (ELSA-2007-0074)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2021/1/14	medium
67450	Oracle Linux 4：spamassassin (ELSA-2007-0074)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2021/1/14	medium
24696	RHEL 4 : spamassassin (RHSA-2007:0074)	Nessus	Red Hat Local Security Checks	2007/2/23	2021/1/14	medium
27451	openSUSE 10 Security Update : spamassassin (spamassassin-3077)	Nessus	SuSE Local Security Checks	2007/10/17	2021/1/14	medium
24360	Fedora Core 6 : spamassassin-3.1.8-1.fc6 (2007-241)	Nessus	Fedora Local Security Checks	2007/2/17	2021/1/11	medium
24750	GLSA-200703-02 : SpamAssassin: Long URI Denial of Service	Nessus	Gentoo Local Security Checks	2007/3/2	2021/1/6	medium
25316	RHEL 5 : spamassassin (RHSA-2007:0075)	Nessus	Red Hat Local Security Checks	2007/5/25	2021/1/14	medium
24702	CentOS 4 : spamassassin (CESA-2007:0074)	Nessus	CentOS Local Security Checks	2007/2/26	2021/1/4	medium
24706	Mandrake Linux Security Advisory : spamassassin (MDKSA-2007:049)	Nessus	Mandriva Local Security Checks	2007/2/26	2021/1/6	medium
67450	Oracle Linux 4 : spamassassin (ELSA-2007-0074)	Nessus	Oracle Linux Local Security Checks	2013/7/12	2021/1/14	medium
3918	SpamAssassin < 3.1.8 Malformed HTML Long URI DoS	Nessus Network Monitor	SMTP Clients	2007/2/16	2019/3/6	medium

偵測

搜尋 Plugin

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium