[oss-security] [SECURITY] Apache SpamAssassin 3.4.2 resolves CVE-2017-15705, CVE-2016-1238, CVE-2018-11780 & CVE-2018-11781

[Kevin A. McGrail]

Apache SpamAssassin 3.4.2 was recently released [1], and fixes several
issues of security note.

First, a denial of service vulnerability that exists in all modern versions.

The vulnerability arises with certain unclosed tags in emails that cause
markup to be handled incorrectly leading to scan timeouts.

In Apache SpamAssassin, using HTML::Parser, we setup an object and hook
into the begin and end tag event handlers  In both cases, the "open"
event is immediately followed by a "close" event - even if the tag *does
not* close in the HTML being parsed.

Because of this, we are missing the "text" event to deal with the object
normally.  This can cause carefully crafted emails that might take more
scan time than expected leading to a Denial of Service.

The issue is possibly a bug or design decision in HTML::Parser that
specifically impacts the way Apache SpamAssassin uses the module with
poorly formed html.

The exploit has been seen in the wild but not believe to have been
purposefully part of a Denial of Service attempt.  We are concerned that
there may be attempts to abuse the vulnerability in the future. 
Therefore, we strongly recommend all users of these versions upgrade to
Apache SpamAssassin 3.4.2 as soon as possible.

This issue has been assigned CVE id CVE-2017-15705 [2].


Second, this release also fixes a reliance on "." in @INC in one
configuration script.  Whether this can be exploited in any way is
uncertain.

This issue has been assigned CVE id CVE-2016-1238 [3].


Third, this release fixes a potential Remote Code Execution bug with the
PDFInfo plugin.  Thanks to cPanel Security Team for their report of this
issue.

This issue has been assigned CVE id CVE-2018-11780 [4].


Fourth, this release fixes a local user code injection in the meta rule
syntax. Thanks again to cPanel Security Team for their report of this issue.

This issue has been assigned CVE id CVE-2018-11781 [5].


To contact the Apache SpamAssassin security team, please e-mail
security at spamassassin.apache.org.  For more information about Apache
SpamAssassin, visit the http://spamassassin.apache.org/ web site.

Apache SpamAssassin Security Team

[1]:
https://lists.apache.org/thread.html/1ac11532235b5459aa16c4e9d636bf4aa0b141d347d1361e40cc1b78@%3Cannounce.apache.org%3E

[2]: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2017-15705

[3]: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2016-1238

[4]: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2018-11780

[5]: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2018-11781

[Reindl Harald]

i doubt that it is wiese to blwo out security notes *that short* after
release and *that long* after the last release

Post by Kevin A. McGrail
Apache SpamAssassin 3.4.2 was recently released [1], and fixes several
issues of security note.
First, a denial of service vulnerability that exists in all modern versions.
The vulnerability arises with certain unclosed tags in emails that cause
markup to be handled incorrectly leading to scan timeouts.
In Apache SpamAssassin, using HTML::Parser, we setup an object and hook
into the begin and end tag event handlers  In both cases, the "open"
event is immediately followed by a "close" event - even if the tag *does
not* close in the HTML being parsed.
Because of this, we are missing the "text" event to deal with the object
normally.  This can cause carefully crafted emails that might take more
scan time than expected leading to a Denial of Service.
The issue is possibly a bug or design decision in HTML::Parser that
specifically impacts the way Apache SpamAssassin uses the module with
poorly formed html.
The exploit has been seen in the wild but not believe to have been
purposefully part of a Denial of Service attempt.  We are concerned that
there may be attempts to abuse the vulnerability in the future. 
Therefore, we strongly recommend all users of these versions upgrade to
Apache SpamAssassin 3.4.2 as soon as possible.
This issue has been assigned CVE id CVE-2017-15705 [2].
configuration script.  Whether this can be exploited in any way is
uncertain.
This issue has been assigned CVE id CVE-2016-1238 [3].
Third, this release fixes a potential Remote Code Execution bug with the
PDFInfo plugin.  Thanks to cPanel Security Team for their report of this
issue.
This issue has been assigned CVE id CVE-2018-11780 [4].
Fourth, this release fixes a local user code injection in the meta rule
syntax. Thanks again to cPanel Security Team for their report of this issue.
This issue has been assigned CVE id CVE-2018-11781 [5].
To contact the Apache SpamAssassin security team, please e-mail
security at spamassassin.apache.org.  For more information about Apache
SpamAssassin, visit the http://spamassassin.apache.org/ web site.
Apache SpamAssassin Security Team
[2]: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2017-15705
[3]: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2016-1238
[4]: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2018-11780
[5]: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2018-11781

[Kevin A. McGrail]

Per the asf security team, mitre considers the public rc1 from a few days
ago as the start of the clock for the publishing so we were already way
past the 24 hour windiw.

Hopefully, the announcements and reports are obfuscated and bugzilla ia
private so it'll be contained.

Post by Reindl Harald
i doubt that it is wiese to blwo out security notes *that short* after
release and *that long* after the last release

Post by Kevin A. McGrail
Apache SpamAssassin 3.4.2 was recently released [1], and fixes several
issues of security note.
First, a denial of service vulnerability that exists in all modern

versions.

Post by Kevin A. McGrail
The vulnerability arises with certain unclosed tags in emails that cause
markup to be handled incorrectly leading to scan timeouts.
In Apache SpamAssassin, using HTML::Parser, we setup an object and hook
into the begin and end tag event handlers In both cases, the "open"
event is immediately followed by a "close" event - even if the tag *does
not* close in the HTML being parsed.
Because of this, we are missing the "text" event to deal with the object
normally. This can cause carefully crafted emails that might take more
scan time than expected leading to a Denial of Service.
The issue is possibly a bug or design decision in HTML::Parser that
specifically impacts the way Apache SpamAssassin uses the module with
poorly formed html.
The exploit has been seen in the wild but not believe to have been
purposefully part of a Denial of Service attempt. We are concerned that
there may be attempts to abuse the vulnerability in the future.
Therefore, we strongly recommend all users of these versions upgrade to
Apache SpamAssassin 3.4.2 as soon as possible.
This issue has been assigned CVE id CVE-2017-15705 [2].
configuration script. Whether this can be exploited in any way is
uncertain.
This issue has been assigned CVE id CVE-2016-1238 [3].
Third, this release fixes a potential Remote Code Execution bug with the
PDFInfo plugin. Thanks to cPanel Security Team for their report of this
issue.
This issue has been assigned CVE id CVE-2018-11780 [4].
Fourth, this release fixes a local user code injection in the meta rule
syntax. Thanks again to cPanel Security Team for their report of this

issue.

Post by Kevin A. McGrail
This issue has been assigned CVE id CVE-2018-11781 [5].
To contact the Apache SpamAssassin security team, please e-mail
security at spamassassin.apache.org. For more information about Apache
SpamAssassin, visit the http://spamassassin.apache.org/ web site.
Apache SpamAssassin Security Team
[2]: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2017-15705
[3]: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2016-1238
[4]: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2018-11780
[5]: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2018-11781

[Reindl Harald]

Post by Kevin A. McGrail
Per the asf security team, mitre considers the public rc1 from a few
days ago as the start of the clock for the publishing so we were already
way past the 24 hour windiw.

again: i doubt that distributions push updates *NOW* because most
maintainers are not ware of the release nor do the expecit it at all
given how long we hear about 3.4.2 with no other official bugfix
releases for years

bad guys typically watch better than anyone else

Post by Kevin A. McGrail
Hopefully, the announcements and reports are obfuscated and bugzilla ia
private so it'll be contained.
i doubt that it is wiese to blwo out security notes *that short* after
release and *that long* after the last release

[Leo Famulari]

Post by Reindl Harald
bad guys typically watch better than anyone else

Agreed, that's why it's important to publicize the vulnerability so that
the "good people" notice it quickly.