SpamAssassin 3, Vipul's Razor: Denial of Service vulnerability

Background

SpamAssassin is an extensible email filter which is used to identify junk email. Vipul’s Razor is a client for a distributed, collaborative spam detection and filtering network.

Description

SpamAssassin and Vipul’s Razor contain a Denial of Service vulnerability when handling special misformatted long message headers.

Impact

By sending a specially crafted message an attacker could cause a Denial of Service attack against the SpamAssassin/Vipul’s Razor server.

Workaround

There is no known workaround at this time.

Resolution

All SpamAssassin users should upgrade to the latest version:

 # emerge --sync
 # emerge --ask --oneshot --verbose ">=mail-filter/spamassassin-3.0.4"

All Vipul’s Razor users should upgrade to the latest version:

 # emerge --sync
 # emerge --ask --oneshot --verbose ">=mail-filter/razor-2.74"