bugSpamAssassin Milter Plugin - Bugs: bug #29136, SpamAssassin Milter Plugin Input...

 
 

bug #29136: SpamAssassin Milter Plugin Input Validation Flaw Lets Remote Users Execute Arbitrary Code

Submitter:  Robert Schetterer <rschetterer>
Submitted:  Tue 09 Mar 2010 12:34:50 PM UTC
   
 
Category:  None Severity:  3 - Normal
Item Group:  None Status:  Fixed
Privacy:  Public Assigned to:  dnelson
Open/Closed:  Closed
* Mandatory Fields

Add a New Comment Rich Markup
   

Jump to the original submission

Fri 15 Aug 2014 01:55:36 AM UTC, comment #12: 

This was patched in 0.3.2 but will explicitly mention it in the next release.

Todd Kover <kovert>
Group administrator
Fri 07 May 2010 03:25:27 AM UTC, comment #11: 

Any news on this moving forwards?

Anonymous
Mon 19 Apr 2010 08:45:01 PM UTC, comment #10: 

The preliminary patch has a major flaw: it does not reap any of the child processes it creates, resulting in a new zombie sendmail process for each call to popenv(). This eventually results in resource starvation and the milter rejecting emails due to being unable to fork or create a new thread.

Ref:
http://bugzilla.redhat.com/583523
http://bugs.debian.org/575019

I have attached a revised patch to Bug #29326 that adds an additional parameter to popenv() to return the PID of the child process, enabling the caller to use waitpid() when closing the pipe and avoid the zombie processes. This patch is based on the one from Bjørn Mork in the Debian bug report.

Paul Howarth <pghmcfc>
Fri 26 Mar 2010 11:12:09 PM UTC, comment #9: 

This is now assigned CVE-2010-1132.

Paul Howarth <pghmcfc>
Wed 17 Mar 2010 04:23:00 PM UTC, comment #8: 

when this bug gets fixed , there should be a release update
to make clear that this got fixed, also other patches
i.e. smtp auth should be included too then

Robert Schetterer <rschetterer>
Tue 16 Mar 2010 08:36:48 PM UTC, comment #7: 

Spam bucket works too with the patch.

I think it's worth updating the docs to mention that the milter must be run as root to use the -x option.

Paul Howarth <pghmcfc>
Tue 16 Mar 2010 05:20:55 PM UTC, comment #6: 

Patch looks reasonable, but needs a function prototype adding for popenv() above where it's called in main().

I had to hack my initscript a bit to get the milter to run as root so that I could test out -u -x (-x only works if the milter runs as root). I also had to tweak the sample exploit slightly to get it past sendmail, which rejects the "|" exploit with a "Cannot mail directly to programs" error. And finally, I had to turn off SELinux enforcing mode to be able to write to /tmp, which would otherwise be blocked by SELinux policy, at least in current Fedora releases.

Instead of:
rcpt to: root+:"|touch /tmp/foo"

I used:
rcpt to: root+" ; touch /tmp/foo ; echo "

Without the patch, this created /tmp/foo; with the patch, it didn't. Normal mail delivery is working fine but I'm still awaiting a spam mail to check that the spambucket still works (going home now so will report back later).

Paul Howarth <pghmcfc>
Wed 10 Mar 2010 06:59:07 PM UTC, comment #5: 

preliminary patch attached.  I don't use -r -b or -u -x myself so I'll need to set it up on a test box to make sure it works.


(file #19902)

Dan Nelson <dnelson>
Group administrator
Wed 10 Mar 2010 06:53:14 PM UTC, comment #4: 

The use of popen() for the spambucket case isn't a problem though, is it, since it's not passing user-supplied input through the shell - only the admin-supplied spambucket address?

I like the popenv() approach though.

Paul Howarth <pghmcfc>
Wed 10 Mar 2010 06:02:34 PM UTC, comment #3: 

Bah. 

popen is actually used twice, once in read mode (to expand the -x address), and once in write mode (for the spam bucket option).  I'll add a popenv function (taking an argv array like execv), which will minimize the diff.

Dan Nelson <dnelson>
Group administrator
Wed 10 Mar 2010 04:43:28 PM UTC, comment #2: 

There was a remarkably similar issue with clamav in 2007 (CVE-2007-4560). I've had a go at writing a patch based on the clamav code (which is GPL version 2 or later, like spamass-milter) but have not had time to test it today.

I'll have a go at testing it tomorrow if nobody else has had time to do so in the meantime.

(file #19901)

Paul Howarth <pghmcfc>
Tue 09 Mar 2010 01:09:50 PM UTC, comment #1: 

-x seems to be safe with postfix and the right setup
for small tests if using
reject_non_fqdn_recipient

i.e

smtpd_recipient_restrictions = reject_unknown_recipient_domain,
                               reject_non_fqdn_recipient,
                               permit_mynetworks,
                               .....


--test

mail from:robowarp@gmx.de
503 5.5.1 Error: send HELO/EHLO first
helo mail.gmx.de
250 postmailer.nci.de
mail from:robowarp@gmx.de
250 2.1.0 Ok
rcpt to: root+:"|touch /tmp/foo"
504 5.5.2 <root+:|touch /tmp/foo>: Recipient address rejected: need fully-qualified address
quit
221 2.0.0 Bye

anyway it should be fixed asap

Robert Schetterer <rschetterer>
Tue 09 Mar 2010 12:34:50 PM UTC, original submission:  

Version(s): 0.3.1; possibly earlier versions
Description:   A vulnerability was reported in SpamAssassin Milter Plugin. A remote user can execute arbitrary code on the target system.

When the software is invoked with the expand (-x) flag, the software makes an unsafe popen() call. A remote user can send a specially crafted RCPT TO value to execute arbitrary code on the target system. The code will run with the privileges of the target service.

look
http://securitytracker.com/id?1023691

Robert Schetterer <rschetterer>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

Attached Files
file #19902:  popen.diff added by dnelson (6KiB - application/octet-stream - popenv() replacement patch, also untested)
file #19901:  spamass-milter-0.3.1-popen.patch added by pghmcfc (4KiB - application/octet-stream - Untested patch, removing popen() call and replacing it with execl())

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by kovert (Posted a comment)
  • -email is unavailable- added by dnelson (Posted a comment)
  • -email is unavailable- added by pghmcfc (Updated the item)
  • -email is unavailable- added by pghmcfc (Fedora package maintainer)
  • -email is unavailable- added by rschetterer (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 7 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2014-09-11 kovert StatusReady For Test Fixed
        Open/ClosedOpen Closed
    2014-08-15 kovert StatusNone Ready For Test
    2010-03-10 dnelson Attached File- Added popen.diff, #19902
    2010-03-10 dnelson Assigned toNone dnelson
    2010-03-10 pghmcfc Attached File- Added spamass-milter-0.3.1-popen.patch, #19901
    2010-03-10 pghmcfc Carbon-Copy- Added pghmcfc

    Back to the top

    Powered by Savane 3.13-cf05.
    Corresponding source code