SpamAssassin contains a flaw that may allow a malicious user to execute arbitrary commands. The issue is triggered when sending shell commands in the User filed, resulting in a loss of confidentiality and integrity.
Classification
Location:
Remote / Network Access,
Context Dependent
Attack Type:
Input Manipulation
Impact:
Loss of Confidentiality,
Loss of Integrity
Solution:
Workaround,
Upgrade
Exploit:
Exploit Public,
Exploit Commercial
Disclosure:
Vendor Verified
OSVDB:
Security Software
Solution
Upgrade to version 3.1.3 or 3.0.6 as the vendor has released a patch to address this issue, or users may opt to apply the following workaround: do not use the vpopmail (-v) and paranoid (-p) modes together, or limit remote access using the allowed IPs (-A) switches.
