bugSpamAssassin Milter Plugin - Bugs: bug #29136, SpamAssassin Milter Plugin Input...

 
 

bug #29136: SpamAssassin Milter Plugin Input Validation Flaw Lets Remote Users Execute Arbitrary Code

Submitted by:  Robert Schetterer <rschetterer>
Submitted on:  Tue 09 Mar 2010 12:34:50 PM UTC  
 
Category: NoneSeverity: 3 - Normal
Item Group: NoneStatus: Fixed
Privacy: PublicAssigned to: Dan Nelson <dnelson>
Open/Closed: Closed

Add a New Comment (Rich MarkupRich Markup):
   

You are not logged in

Please log in, so followups can be emailed to you.

 

(Jump to the original submission Jump to the original submission)

Fri 15 Aug 2014 01:55:36 AM UTC, comment #12:

This was patched in 0.3.2 but will explicitly mention it in the next release.

Todd Kover <kovert>
Project Administrator
Fri 07 May 2010 03:25:27 AM UTC, comment #11:

Any news on this moving forwards?

Anonymous
Mon 19 Apr 2010 08:45:01 PM UTC, comment #10:

The preliminary patch has a major flaw: it does not reap any of the child processes it creates, resulting in a new zombie sendmail process for each call to popenv(). This eventually results in resource starvation and the milter rejecting emails due to being unable to fork or create a new thread.

Ref:
http://bugzilla.redhat.com/583523
http://bugs.debian.org/575019

I have attached a revised patch to Bug #29326 that adds an additional parameter to popenv() to return the PID of the child process, enabling the caller to use waitpid() when closing the pipe and avoid the zombie processes. This patch is based on the one from Bjørn Mork in the Debian bug report.

Paul Howarth <pghmcfc>
Fri 26 Mar 2010 11:12:09 PM UTC, comment #9:

This is now assigned CVE-2010-1132.

Paul Howarth <pghmcfc>
Wed 17 Mar 2010 04:23:00 PM UTC, comment #8:

when this bug gets fixed , there should be a release update
to make clear that this got fixed, also other patches
i.e. smtp auth should be included too then

Robert Schetterer <rschetterer>
Tue 16 Mar 2010 08:36:48 PM UTC, comment #7:

Spam bucket works too with the patch.

I think it's worth updating the docs to mention that the milter must be run as root to use the -x option.

Paul Howarth <pghmcfc>
Tue 16 Mar 2010 05:20:55 PM UTC, comment #6:

Patch looks reasonable, but needs a function prototype adding for popenv() above where it's called in main().

I had to hack my initscript a bit to get the milter to run as root so that I could test out -u -x (-x only works if the milter runs as root). I also had to tweak the sample exploit slightly to get it past sendmail, which rejects the "|" exploit with a "Cannot mail directly to programs" error. And finally, I had to turn off SELinux enforcing mode to be able to write to /tmp, which would otherwise be blocked by SELinux policy, at least in current Fedora releases.

Instead of:
rcpt to: root+:"|touch /tmp/foo"

I used:
rcpt to: root+" ; touch /tmp/foo ; echo "

Without the patch, this created /tmp/foo; with the patch, it didn't. Normal mail delivery is working fine but I'm still awaiting a spam mail to check that the spambucket still works (going home now so will report back later).

Paul Howarth <pghmcfc>
Wed 10 Mar 2010 06:59:07 PM UTC, comment #5:

preliminary patch attached. I don't use -r -b or -u -x myself so I'll need to set it up on a test box to make sure it works.

(file #19902)

Dan Nelson <dnelson>
Project AdministratorIn charge of this item.
Wed 10 Mar 2010 06:53:14 PM UTC, comment #4:

The use of popen() for the spambucket case isn't a problem though, is it, since it's not passing user-supplied input through the shell - only the admin-supplied spambucket address?

I like the popenv() approach though.

Paul Howarth <pghmcfc>
Wed 10 Mar 2010 06:02:34 PM UTC, comment #3:

Bah.

popen is actually used twice, once in read mode (to expand the -x address), and once in write mode (for the spam bucket option). I'll add a popenv function (taking an argv array like execv), which will minimize the diff.

Dan Nelson <dnelson>
Project AdministratorIn charge of this item.
Wed 10 Mar 2010 04:43:28 PM UTC, comment #2:

There was a remarkably similar issue with clamav in 2007 (CVE-2007-4560). I've had a go at writing a patch based on the clamav code (which is GPL version 2 or later, like spamass-milter) but have not had time to test it today.

I'll have a go at testing it tomorrow if nobody else has had time to do so in the meantime.

(file #19901)

Paul Howarth <pghmcfc>
Tue 09 Mar 2010 01:09:50 PM UTC, comment #1:

-x seems to be safe with postfix and the right setup
for small tests if using
reject_non_fqdn_recipient

i.e

smtpd_recipient_restrictions = reject_unknown_recipient_domain,
reject_non_fqdn_recipient,
permit_mynetworks,
.....

--test

mail from:robowarp@gmx.de
503 5.5.1 Error: send HELO/EHLO first
helo mail.gmx.de
250 postmailer.nci.de
mail from:robowarp@gmx.de
250 2.1.0 Ok
rcpt to: root+:"|touch /tmp/foo"
504 5.5.2 <root+:|touch /tmp/foo>: Recipient address rejected: need fully-qualified address
quit
221 2.0.0 Bye

anyway it should be fixed asap

Robert Schetterer <rschetterer>
Tue 09 Mar 2010 12:34:50 PM UTC, original submission:

Version(s): 0.3.1; possibly earlier versions
Description: A vulnerability was reported in SpamAssassin Milter Plugin. A remote user can execute arbitrary code on the target system.

When the software is invoked with the expand (-x) flag, the software makes an unsafe popen() call. A remote user can send a specially crafted RCPT TO value to execute arbitrary code on the target system. The code will run with the privileges of the target service.

look
http://securitytracker.com/id?1023691

Robert Schetterer <rschetterer>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

Attached Files
file #19902:  popen.diff added by dnelson (6kB - application/octet-stream - popenv() replacement patch, also untested)
file #19901:  spamass-milter-0.3.1-popen.patch added by pghmcfc (4kB - application/octet-stream - Untested patch, removing popen() call and replacing it with execl())

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by kovert (Posted a comment)
  • -unavailable- added by dnelson (Posted a comment)
  • -unavailable- added by pghmcfc (Updated the item)
  • -unavailable- added by pghmcfc (Fedora package maintainer)
  • -unavailable- added by rschetterer (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 7 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Thu 11 Sep 2014 01:08:16 AM UTCkovertStatusReady For Test=>Fixed
      Open/ClosedOpen=>Closed
    Fri 15 Aug 2014 01:55:36 AM UTCkovertStatusNone=>Ready For Test
    Wed 10 Mar 2010 06:59:07 PM UTCdnelsonAttached File-=>Added popen.diff, #19902
    Wed 10 Mar 2010 06:02:34 PM UTCdnelsonAssigned toNone=>dnelson
    Wed 10 Mar 2010 04:43:28 PM UTCpghmcfcAttached File-=>Added spamass-milter-0.3.1-popen.patch, #19901
    Wed 10 Mar 2010 12:51:16 PM UTCpghmcfcCarbon-Copy-=>Added pghmcfc

    Back to the top


    Powered by Savane 3.1-cleanup