portage-ng / portage / mail-filter / razor / 2.85-r5
version « ‹ 2.85-r5 › »
graphs detail deptree gantt
cli --merge --fetchonly --info
security glsa 1 bugs
legacy emerge pmerge
portage-ng glsa
1 advisory reference mail-filter/razor · none place version 2.85-r5 in a vulnerable range
▸ GLSA 200506-17 SpamAssassin 3, Vipul's Razor: Denial of Service vulnerability this version unaffected normal remote 2005-06-21

SpamAssassin and Vipul's Razor are vulnerable to a Denial of Service attack when handling certain malformed messages.

Announced
2005-06-21
Revised
2006-05-22 (revision 3)
Access
remote
Bugs
#94722 #95492 #96776
Advisory
https://security.gentoo.org/glsa/200506-17

Affected packages

PackageArchVulnerableUnaffected
mail-filter/razor*< 2.74>= 2.74
mail-filter/spamassassin*< 3.0.4>= 3.0.4, < 3.0.1

Background

SpamAssassin is an extensible email filter which is used to identify junk email. Vipul's Razor is a client for a distributed, collaborative spam detection and filtering network.

Description

SpamAssassin and Vipul's Razor contain a Denial of Service vulnerability when handling special misformatted long message headers.

Impact

By sending a specially crafted message an attacker could cause a Denial of Service attack against the SpamAssassin/Vipul's Razor server.

Workaround

There is no known workaround at this time.

Resolution

All SpamAssassin users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=mail-filter/spamassassin-3.0.4"

All Vipul's Razor users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=mail-filter/razor-2.74"

References