Date: Thu, 14 Jun 2007 14:23:18 -0600
From: [email protected]Subject: [ MDKSA-2007:125 ] - Updated spamassassin packages fix possible DoS
condition
To: [email protected]
Reply-To: [email protected]
Message-id: <E1Hyvqg-0005A4-3W@artemis.annvix.ca.>
X-SA-Exim-Connect-IP: 10.0.5.11
X-SA-Exim-Mail-From: [email protected]
X-SA-Exim-Version: 4.2.1 (built Fri, 02 Feb 2007 19:02:33 -0700)
X-SA-Exim-Scanned: Yes (on hades.annvix.org)
X-Virus-Scanned: antivirus-gw at tyumen.ru
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
_______________________________________________________________________
Mandriva Linux Security Advisory MDKSA-2007:125
http://www.mandriva.com/security/
_______________________________________________________________________
Package : spamassassin
Date : June 14, 2007
Affected: 2007.0, 2007.1, Corporate 4.0
_______________________________________________________________________
Problem Description:
SpamAssassin 3.1.x, when running as root with unusual configuration
options using vpopmail or virtual users, could allow local users to
cause a denial of service (via corrupting arbitrary files) using a
symlink attack on a file used by spamd.
SpamAssassin 3.1.9, which corrects this flaw, is provided with
this update.
_______________________________________________________________________
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2873http://spamassassin.apache.org/advisories/cve-2007-2873.txt
_______________________________________________________________________
Updated Packages:
Mandriva Linux 2007.0:
6868ff1682b0af4f4a1496d1b17b1abb 2007.0/i586/perl-Mail-SpamAssassin-3.1.9-0.1mdv2007.0.i586.rpm
1cedda8aa0bd35a0e745180a45a19979 2007.0/i586/spamassassin-3.1.9-0.1mdv2007.0.i586.rpm
00cffd46beb7733d24a7194e7a269f59 2007.0/i586/spamassassin-spamc-3.1.9-0.1mdv2007.0.i586.rpm
97a3c6aebaf515c2d07ae903e3ade97b 2007.0/i586/spamassassin-spamd-3.1.9-0.1mdv2007.0.i586.rpm
2d17ea30dbc1679f0770415a4f1e93bc 2007.0/i586/spamassassin-tools-3.1.9-0.1mdv2007.0.i586.rpm
5cd9896b49fed9eb8fc774167d74244c 2007.0/SRPMS/spamassassin-3.1.9-0.1mdv2007.0.src.rpm
Mandriva Linux 2007.0/X86_64:
136b4b7726af7e858bdfd416a590bc69 2007.0/x86_64/perl-Mail-SpamAssassin-3.1.9-0.1mdv2007.0.x86_64.rpm
d9e416f10cfc5ea29cc6f5fe683b5dda 2007.0/x86_64/spamassassin-3.1.9-0.1mdv2007.0.x86_64.rpm
7abe66bb43c8dd00cad3759664c6bf65 2007.0/x86_64/spamassassin-spamc-3.1.9-0.1mdv2007.0.x86_64.rpm
5ea0a2c56eb2ac07df39ec1a578ce385 2007.0/x86_64/spamassassin-spamd-3.1.9-0.1mdv2007.0.x86_64.rpm
ef19bf0d92d5ba5191669bad149c78c5 2007.0/x86_64/spamassassin-tools-3.1.9-0.1mdv2007.0.x86_64.rpm
5cd9896b49fed9eb8fc774167d74244c 2007.0/SRPMS/spamassassin-3.1.9-0.1mdv2007.0.src.rpm
Mandriva Linux 2007.1:
c346bacaf0032d8b04c7d8d0fd3d5e58 2007.1/i586/perl-Mail-SpamAssassin-3.1.9-0.1mdv2007.1.i586.rpm
bcf67361bf441a9e3b3783d0f3802449 2007.1/i586/spamassassin-3.1.9-0.1mdv2007.1.i586.rpm
524d9f34a21b63bd60e23f9e3b10ab72 2007.1/i586/spamassassin-spamc-3.1.9-0.1mdv2007.1.i586.rpm
4d15df1d52591e597b504801e3b48fa9 2007.1/i586/spamassassin-spamd-3.1.9-0.1mdv2007.1.i586.rpm
7d5394511014e74ec8f1407820fd0646 2007.1/i586/spamassassin-tools-3.1.9-0.1mdv2007.1.i586.rpm
b261e57f3a15bd6f2c0b1d1fe731723d 2007.1/SRPMS/spamassassin-3.1.9-0.1mdv2007.1.src.rpm
Mandriva Linux 2007.1/X86_64:
92b56f81d9602aa7c78799a368f5a227 2007.1/x86_64/perl-Mail-SpamAssassin-3.1.9-0.1mdv2007.1.x86_64.rpm
63d5278e935c222cc07ce10f25921a01 2007.1/x86_64/spamassassin-3.1.9-0.1mdv2007.1.x86_64.rpm
c461b6faf2a7c6283d8380e9ff45c66f 2007.1/x86_64/spamassassin-spamc-3.1.9-0.1mdv2007.1.x86_64.rpm
ea4ec4e59e5f7589bed9463fbcf09ccb 2007.1/x86_64/spamassassin-spamd-3.1.9-0.1mdv2007.1.x86_64.rpm
eab7972520d2ff2dae31eb3facae2caa 2007.1/x86_64/spamassassin-tools-3.1.9-0.1mdv2007.1.x86_64.rpm
b261e57f3a15bd6f2c0b1d1fe731723d 2007.1/SRPMS/spamassassin-3.1.9-0.1mdv2007.1.src.rpm
Corporate 4.0:
91fe3692a86bc63d73b2cd65b9a7680d corporate/4.0/i586/perl-Mail-SpamAssassin-3.1.9-0.1.20060mlcs4.i586.rpm
576704ea8dc89097e611c5ffaf1e604f corporate/4.0/i586/spamassassin-3.1.9-0.1.20060mlcs4.i586.rpm
47fef4374240c6c6f7c475b675e620ee corporate/4.0/i586/spamassassin-spamc-3.1.9-0.1.20060mlcs4.i586.rpm
c10a0adc7e9c1a0d4ee7ae7ca981fefc corporate/4.0/i586/spamassassin-spamd-3.1.9-0.1.20060mlcs4.i586.rpm
f1d5308b7bcce9eed20028623b98fa02 corporate/4.0/i586/spamassassin-tools-3.1.9-0.1.20060mlcs4.i586.rpm
e05b3f4264eccec4af0204b2d86009e0 corporate/4.0/SRPMS/spamassassin-3.1.9-0.1.20060mlcs4.src.rpm
Corporate 4.0/X86_64:
ee0e50378b04981186e363e9ffd46a0c corporate/4.0/x86_64/perl-Mail-SpamAssassin-3.1.9-0.1.20060mlcs4.x86_64.rpm
deb4f200369c92ece52b62dd40485ec1 corporate/4.0/x86_64/spamassassin-3.1.9-0.1.20060mlcs4.x86_64.rpm
bef27fbaf42eea12e584a0ebca872b77 corporate/4.0/x86_64/spamassassin-spamc-3.1.9-0.1.20060mlcs4.x86_64.rpm
ed5b1d4c8e9c65dbe47e3c52d98928f5 corporate/4.0/x86_64/spamassassin-spamd-3.1.9-0.1.20060mlcs4.x86_64.rpm
287bde6ce88bb820d788e0017b19d39b corporate/4.0/x86_64/spamassassin-tools-3.1.9-0.1.20060mlcs4.x86_64.rpm
e05b3f4264eccec4af0204b2d86009e0 corporate/4.0/SRPMS/spamassassin-3.1.9-0.1.20060mlcs4.src.rpm
_______________________________________________________________________
To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.
All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:
gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandriva Linux at:
http://www.mandriva.com/security/advisories
If you want to report vulnerabilities, please contact
security_(at)_mandriva.com
_______________________________________________________________________
Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (GNU/Linux)
iD8DBQFGcXj+mqjQ0CJFipgRArukAJ41azTr7OCDXVE8pIbFeEMSYpWvYQCdFDv4
B2jtwebSsYZyCH2GIReV+lc=
=NOIn
-----END PGP SIGNATURE-----
