[security-alerts] FW: [SA17386] SpamAssassin Long Message Header Denial of Service

["Kazennov, Vladimir" <Vladimir.Kazennov@xxxxxxxxxx>]

> 
> 
> TITLE:
> SpamAssassin Long Message Header Denial of Service
> 
> SECUNIA ADVISORY ID:
> SA17386
> 
> VERIFY ADVISORY:
> http://secunia.com/advisories/17386/
> 
> CRITICAL:
> Less critical
> 
> IMPACT:
> DoS
> 
> WHERE:
> From remote
> 
> SOFTWARE:
> SpamAssassin 3.x
> http://secunia.com/product/4506/
> 
> DESCRIPTION:
> A vulnerability has been reported in SpamAssassin, which can be
> exploited by malicious people to cause a DoS (Denial of Service).
> 
> The vulnerability is caused due to the use of an inefficient regular
> expression in "/SpamAssassin/Message.pm" to parse email headers. This
> can cause perl to crash when it runs out of stack space and can be
> exploited via a malicious email that contains a large number of
> recipients.
> 
> The vulnerability has been reported in version 3.0.4. Prior versions
> may also be affected.
> 
> SOLUTION:
> Update to version 3.1.0.
> http://spamassassin.apache.org/downloads.cgi?update=200509141634
> 
> PROVIDED AND/OR DISCOVERED BY:
> Irina and Mark Martinec.
> 
> ORIGINAL ADVISORY:
> http://issues.apache.org/SpamAssassin/show_bug.cgi?id=4570
>