RHEL 4 : spamassassin (RHSA-2006:0543) - Nessus

Medium   Plugin ID: 21672

This page contains detailed information about the RHEL 4 : spamassassin (RHSA-2006:0543) Nessus plugin including available exploits and PoCs found on GitHub, in Metasploit or Exploit-DB for verifying of this vulnerability.

Plugin Overview


ID: 21672
Name: RHEL 4 : spamassassin (RHSA-2006:0543)
Filename: redhat-RHSA-2006-0543.nasl
Vulnerability Published: 2006-06-06
This Plugin Published: 2006-06-08
Last Modification Time: 2021-01-14
Plugin Version: 1.25
Plugin Type: local
Plugin Family: Red Hat Local Security Checks
Dependencies: ssh_get_info.nasl
Required KB Items [?]: Host/cpu, Host/local_checks_enabled, Host/RedHat/release, Host/RedHat/rpm-list

Vulnerability Information


Severity: Medium
Vulnerability Published: 2006-06-06
Patch Published: 2006-06-06
CVE [?]: CVE-2006-2447
CPE [?]: cpe:/o:redhat:enterprise_linux:4, p-cpe:/a:redhat:enterprise_linux:spamassassin

Synopsis

The remote Red Hat host is missing a security update.

Description

Updated spamassassin packages that fix an arbitrary code execution flaw are now available.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

SpamAssassin provides a way to reduce unsolicited commercial email (SPAM) from incoming email.

A flaw was found with the way the Spamassassin spamd daemon processes the virtual pop username passed to it. If a site is running spamd with both the --vpopmail and --paranoid flags, it is possible for a remote user with the ability to connect to the spamd daemon to execute arbitrary commands as the user running the spamd daemon. (CVE-2006-2447)

Note: None of the IMAP or POP servers shipped with Red Hat Enterprise Linux 4 support vpopmail delivery. Running spamd with the --vpopmail and --paranoid flags is uncommon and not the default startup option as shipped with Red Hat Enterprise Linux 4.

Spamassassin, as shipped in Red Hat Enterprise Linux 4, performs RBL lookups against visi.com to help determine if an email is spam. However, this DNS RBL has recently disappeared, resulting in mail filtering delays and timeouts.

Users of SpamAssassin should upgrade to these updated packages containing version 3.0.6 and backported patches, which are not vulnerable to these issues.

Solution

Update the affected spamassassin package.

Public Exploits


Target Network Port(s): N/A
Target Asset(s): N/A
Exploit Available: True (Metasploit Framework, Exploit-DB)
Exploit Ease: Exploits are available

Here's the list of publicly known exploits and PoCs for verifying the RHEL 4 : spamassassin (RHSA-2006:0543) vulnerability:

  1. Metasploit: exploit/unix/misc/spamassassin_exec
    [SpamAssassin spamd Remote Command Execution]
  2. Exploit-DB: exploits/unix/remote/9914.rb
    [EDB-9914: SpamAssassin spamd 3.1.3 - Command Injection (Metasploit)]
  3. Exploit-DB: exploits/linux/remote/16920.rb
    [EDB-16920: SpamAssassin spamd - Remote Command Execution (Metasploit)]

Before running any exploit against any system, make sure you are authorized by the owner of the target system(s) to perform such activity. In any other case, this would be considered as an illegal activity.

WARNING: Beware of using unverified exploits from sources such as GitHub or Exploit-DB. These exploits and PoCs could contain malware. For more information, see how to use exploits safely.

Risk Information


CVSS V2 Vector [?]: AV:N/AC:H/Au:N/C:P/I:P/A:P
CVSS Base Score:5.1 (Medium)
Impact Subscore:6.4
Exploitability Subscore:4.9
CVSS Temporal Score:NA (None)
CVSS Environmental Score:NA (None)
Modified Impact Subscore:NA
Overall CVSS Score:5.1 (Medium)

Go back to menu.

Plugin Source


This is the redhat-RHSA-2006-0543.nasl nessus plugin source code. This script is Copyright (C) 2006-2021 and is owned by Tenable, Inc. or an Affiliate thereof.

#%NASL_MIN_LEVEL 70300
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were  
# extracted from Red Hat Security Advisory RHSA-2006:0543. The text 
# itself is copyright (C) Red Hat, Inc.
#

include('deprecated_nasl_level.inc');
include('compat.inc');

if (description)
{
  script_id(21672);
  script_version("1.25");
  script_set_attribute(attribute:"plugin_modification_date", value:"2021/01/14");

  script_cve_id("CVE-2006-2447");
  script_xref(name:"RHSA", value:"2006:0543");

  script_name(english:"RHEL 4 : spamassassin (RHSA-2006:0543)");
  script_summary(english:"Checks the rpm output for the updated package");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote Red Hat host is missing a security update."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"Updated spamassassin packages that fix an arbitrary code execution
flaw are now available.

This update has been rated as having moderate security impact by the
Red Hat Security Response Team.

SpamAssassin provides a way to reduce unsolicited commercial email
(SPAM) from incoming email.

A flaw was found with the way the Spamassassin spamd daemon processes
the virtual pop username passed to it. If a site is running spamd with
both the --vpopmail and --paranoid flags, it is possible for a remote
user with the ability to connect to the spamd daemon to execute
arbitrary commands as the user running the spamd daemon.
(CVE-2006-2447)

Note: None of the IMAP or POP servers shipped with Red Hat Enterprise
Linux 4 support vpopmail delivery. Running spamd with the --vpopmail
and --paranoid flags is uncommon and not the default startup option as
shipped with Red Hat Enterprise Linux 4.

Spamassassin, as shipped in Red Hat Enterprise Linux 4, performs RBL
lookups against visi.com to help determine if an email is spam.
However, this DNS RBL has recently disappeared, resulting in mail
filtering delays and timeouts.

Users of SpamAssassin should upgrade to these updated packages
containing version 3.0.6 and backported patches, which are not
vulnerable to these issues."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://access.redhat.com/security/cve/cve-2006-2447"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://access.redhat.com/errata/RHSA-2006:0543"
  );
  script_set_attribute(
    attribute:"solution", 
    value:"Update the affected spamassassin package."
  );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:H/Au:N/C:P/I:P/A:P");
  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"metasploit_name", value:'SpamAssassin spamd Remote Command Execution');
  script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:redhat:enterprise_linux:spamassassin");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:redhat:enterprise_linux:4");

  script_set_attribute(attribute:"vuln_publication_date", value:"2006/06/06");
  script_set_attribute(attribute:"patch_publication_date", value:"2006/06/06");
  script_set_attribute(attribute:"plugin_publication_date", value:"2006/06/08");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2006-2021 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"Red Hat Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list", "Host/cpu");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("misc_func.inc");
include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/RedHat/release");
if (isnull(release) || "Red Hat" >!< release) audit(AUDIT_OS_NOT, "Red Hat");
os_ver = pregmatch(pattern: "Red Hat Enterprise Linux.*release ([0-9]+(\.[0-9]+)?)", string:release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Red Hat");
os_ver = os_ver[1];
if (! preg(pattern:"^4([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Red Hat 4.x", "Red Hat " + os_ver);

if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$" && "s390" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Red Hat", cpu);

yum_updateinfo = get_kb_item("Host/RedHat/yum-updateinfo");
if (!empty_or_null(yum_updateinfo)) 
{
  rhsa = "RHSA-2006:0543";
  yum_report = redhat_generate_yum_updateinfo_report(rhsa:rhsa);
  if (!empty_or_null(yum_report))
  {
    security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : yum_report 
    );
    exit(0);
  }
  else
  {
    audit_message = "affected by Red Hat security advisory " + rhsa;
    audit(AUDIT_OS_NOT, audit_message);
  }
}
else
{
  flag = 0;
  if (rpm_check(release:"RHEL4", reference:"spamassassin-3.0.6-1.el4")) flag++;

  if (flag)
  {
    security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get() + redhat_report_package_caveat()
    );
    exit(0);
  }
  else
  {
    tested = pkg_tests_get();
    if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
    else audit(AUDIT_PACKAGE_NOT_INSTALLED, "spamassassin");
  }
}

The latest version of this script can be found in these locations depending on your platform:

  • Linux / Unix:
    /opt/nessus/lib/nessus/plugins/redhat-RHSA-2006-0543.nasl
  • Windows:
    C:\ProgramData\Tenable\Nessus\nessus\plugins\redhat-RHSA-2006-0543.nasl
  • Mac OS X:
    /Library/Nessus/run/lib/nessus/plugins/redhat-RHSA-2006-0543.nasl

Go back to menu.

How to Run


Here is how to run the RHEL 4 : spamassassin (RHSA-2006:0543) as a standalone plugin via the Nessus web user interface (https://localhost:8834/):

  1. Click to start a New Scan.
  2. Select Advanced Scan.
  3. Navigate to the Plugins tab.
  4. On the top right corner click to Disable All plugins.
  5. On the left side table select Red Hat Local Security Checks plugin family.
  6. On the right side table select RHEL 4 : spamassassin (RHSA-2006:0543) plugin ID 21672.
  7. Specify the target on the Settings tab and click to Save the scan.
  8. Run the scan.

Here are a few examples of how to run the plugin in the command line. Note that the examples below demonstrate the usage on the Linux / Unix platform.

Basic usage:

/opt/nessus/bin/nasl redhat-RHSA-2006-0543.nasl -t <IP/HOST>

Run the plugin with audit trail message on the console:

/opt/nessus/bin/nasl -a redhat-RHSA-2006-0543.nasl -t <IP/HOST>

Run the plugin with trace script execution written to the console (useful for debugging):

/opt/nessus/bin/nasl -T - redhat-RHSA-2006-0543.nasl -t <IP/HOST>

Run the plugin with using a state file for the target and updating it (useful for running multiple plugins on the target):

/opt/nessus/bin/nasl -K /tmp/state redhat-RHSA-2006-0543.nasl -t <IP/HOST>

Go back to menu.

References


RHSA | Red Hat Security Advisory: See also: Similar and related Nessus plugins:
  • 21999 - CentOS 4 : spamassassin (CESA-2006:0543)
  • 22632 - Debian DSA-1090-1 : spamassassin - programming error
  • 24118 - Fedora Core 5 : spamassassin-3.1.3-1.fc5 (2006-598)
  • 24361 - Fedora Core 5 : spamassassin-3.1.8-1.fc5 (2007-242)
  • 25509 - Fedora Core 5 : spamassassin-3.1.9-1.fc5.1 (2007-584)
  • 21702 - GLSA-200606-09 : SpamAssassin: Execution of arbitrary code
  • 21718 - Mandrake Linux Security Advisory : spamassassin (MDKSA-2006:103)
  • 21673 - SpamAssassin spamd Crafted Message Arbitrary Command Execution
  • 27449 - openSUSE 10 Security Update : spamassassin (spamassassin-1904)

Version


This page has been produced using Nessus Professional 10.1.2 (#68) LINUX, Plugin set 202205072148.
Plugin file redhat-RHSA-2006-0543.nasl version 1.25. For more plugins, visit the Nessus Plugin Library.

Go back to menu.