Fri 15 Aug 2014 01:55:36 AM UTC, comment #12:
This was patched in 0.3.2 but will explicitly mention it in the next release.
|
Fri 07 May 2010 03:25:27 AM UTC, comment #11:
Any news on this moving forwards?
|
Mon 19 Apr 2010 08:45:01 PM UTC, comment #10:
The preliminary patch has a major flaw: it does not reap any of the child processes it creates, resulting in a new zombie sendmail process for each call to popenv(). This eventually results in resource starvation and the milter rejecting emails due to being unable to fork or create a new thread.
Ref:
http://bugzilla.redhat.com/583523
http://bugs.debian.org/575019
I have attached a revised patch to Bug #29326 that adds an additional parameter to popenv() to return the PID of the child process, enabling the caller to use waitpid() when closing the pipe and avoid the zombie processes. This patch is based on the one from Bjørn Mork in the Debian bug report.
|
Fri 26 Mar 2010 11:12:09 PM UTC, comment #9:
This is now assigned CVE-2010-1132.
|
Wed 17 Mar 2010 04:23:00 PM UTC, comment #8:
when this bug gets fixed , there should be a release update
to make clear that this got fixed, also other patches
i.e. smtp auth should be included too then
|
Tue 16 Mar 2010 08:36:48 PM UTC, comment #7:
Spam bucket works too with the patch.
I think it's worth updating the docs to mention that the milter must be run as root to use the -x option.
|
Tue 16 Mar 2010 05:20:55 PM UTC, comment #6:
Patch looks reasonable, but needs a function prototype adding for popenv() above where it's called in main().
I had to hack my initscript a bit to get the milter to run as root so that I could test out -u -x (-x only works if the milter runs as root). I also had to tweak the sample exploit slightly to get it past sendmail, which rejects the "|" exploit with a "Cannot mail directly to programs" error. And finally, I had to turn off SELinux enforcing mode to be able to write to /tmp, which would otherwise be blocked by SELinux policy, at least in current Fedora releases.
Instead of:
rcpt to: root+:"|touch /tmp/foo"
I used:
rcpt to: root+" ; touch /tmp/foo ; echo "
Without the patch, this created /tmp/foo; with the patch, it didn't. Normal mail delivery is working fine but I'm still awaiting a spam mail to check that the spambucket still works (going home now so will report back later).
|
Wed 10 Mar 2010 06:59:07 PM UTC, comment #5:
preliminary patch attached. I don't use -r -b or -u -x myself so I'll need to set it up on a test box to make sure it works.
(file #19902)
|
Wed 10 Mar 2010 06:53:14 PM UTC, comment #4:
The use of popen() for the spambucket case isn't a problem though, is it, since it's not passing user-supplied input through the shell - only the admin-supplied spambucket address?
I like the popenv() approach though.
|
Wed 10 Mar 2010 06:02:34 PM UTC, comment #3:
Bah.
popen is actually used twice, once in read mode (to expand the -x address), and once in write mode (for the spam bucket option). I'll add a popenv function (taking an argv array like execv), which will minimize the diff.
|
Wed 10 Mar 2010 04:43:28 PM UTC, comment #2:
There was a remarkably similar issue with clamav in 2007 (CVE-2007-4560). I've had a go at writing a patch based on the clamav code (which is GPL version 2 or later, like spamass-milter) but have not had time to test it today.
I'll have a go at testing it tomorrow if nobody else has had time to do so in the meantime.
(file #19901)
|
Tue 09 Mar 2010 01:09:50 PM UTC, comment #1:
-x seems to be safe with postfix and the right setup
for small tests if using
reject_non_fqdn_recipient
i.e
smtpd_recipient_restrictions = reject_unknown_recipient_domain,
reject_non_fqdn_recipient,
permit_mynetworks,
.....
--test
mail from:robowarp@gmx.de
503 5.5.1 Error: send HELO/EHLO first
helo mail.gmx.de
250 postmailer.nci.de
mail from:robowarp@gmx.de
250 2.1.0 Ok
rcpt to: root+:"|touch /tmp/foo"
504 5.5.2 <root+:|touch /tmp/foo>: Recipient address rejected: need fully-qualified address
quit
221 2.0.0 Bye
anyway it should be fixed asap
|
Tue 09 Mar 2010 12:34:50 PM UTC, original submission:
Version(s): 0.3.1; possibly earlier versions
Description: A vulnerability was reported in SpamAssassin Milter Plugin. A remote user can execute arbitrary code on the target system.
When the software is invoked with the expand (-x) flag, the software makes an unsafe popen() call. A remote user can send a specially crafted RCPT TO value to execute arbitrary code on the target system. The code will run with the privileges of the target service.
look
http://securitytracker.com/id?1023691
|