Rapid7 Vulnerability & Exploit Database

RHSA-2006:0129: spamassassin security update

Back to Search

RHSA-2006:0129: spamassassin security update



An updated spamassassin package that fixes a denial of service flaw is now available. This update has been rated as having moderate security impact by the Red Hat Security Response Team.

SpamAssassin provides a way to reduce unsolicited commercial email (SPAM) from incoming email. A denial of service bug was found in SpamAssassin. An attacker could construct a message in such a way that would cause SpamAssassin to crash. If a number of these messages are sent, it could lead to a denial of service, potentially preventing the delivery or filtering of email. The Common Vulnerabilities and Exposures project (cve.mitre.org) assigned the name CVE-2005-3351 to this issue. The following issues have also been fixed in this update: * service spamassassin restart sometimes fails * Content Boundary "--" throws off message parser * sa-learn: massive memory usage on large messages * High memory usage with many newlines * service spamassassin messages not translated * Numerous other bug fixes that improve spam filter accuracy and safety Users of SpamAssassin should upgrade to this updated package containing version 3.0.5, which is not vulnerable to these issues.


  • redhat-upgrade-spamassassin

With Rapid7 live dashboards, I have a clear view of all the assets on my network, which ones can be exploited, and what I need to do in order to reduce the risk in my environment in real-time. No other tool gives us that kind of value and insight.

– Scott Cheney, Manager of Information Security, Sierra View Medical Center