arbitrary command execution vulnerability
| Affects | Status | Importance | Assigned to | Milestone | |
|---|---|---|---|---|---|
| opensmtpd (Debian) |
Fix Released
|
Unknown
|
|||
| opensmtpd (Ubuntu) |
Confirmed
|
Critical
|
Unassigned | ||
| Xenial |
Confirmed
|
Critical
|
Unassigned | ||
| Bionic |
Fix Released
|
Critical
|
Unassigned | ||
| Eoan |
Fix Released
|
Critical
|
Unassigned | ||
Bug Description
OpenBSD 6.6 errata 021, February 24, 2020:
An out of bounds read in smtpd allows an attacker to inject arbitrary
commands into the envelope file which are then executed as root.
Separately, missing privilege revocation in smtpctl allows arbitrary
commands to be run with the _smtpq group.
This affects Debian versions since 5.7.3p2 (released upstream
2016-02-02). In particular, every Ubuntu release since xenial is affected.
Quoting from the advisory:
This vulnerability, an out-of-bounds read introduced in December
2015 (commit 80c6a60c, "when peer outputs a multi-line response
..."), is exploitable remotely and leads to the execution of
arbitrary shell commands: either as root, after May 2018 (commit
a8e22235, "switch smtpd to new grammar"); or as any non-root user,
before May 2018.
https:/
The other advisory fixed by the patches does not appear to affect
Debian because /proc/sys/
CVE References
| Changed in opensmtpd (Ubuntu Xenial): | |
| status: | New → Confirmed |
| Changed in opensmtpd (Ubuntu Bionic): | |
| status: | New → Confirmed |
| Changed in opensmtpd (Ubuntu Eoan): | |
| status: | New → Confirmed |
| Changed in opensmtpd (Ubuntu Xenial): | |
| importance: | Undecided → Critical |
| Changed in opensmtpd (Ubuntu Bionic): | |
| importance: | Undecided → Critical |
| Changed in opensmtpd (Ubuntu Eoan): | |
| importance: | Undecided → Critical |
| Changed in opensmtpd (Ubuntu): | |
| status: | Confirmed → Fix Released |
| Ryan Kavanagh (ryanakca) wrote | #1 |
| Changed in opensmtpd (Ubuntu): | |
| status: | Fix Released → Confirmed |
| Mike Salvatore (mikesalvatore) wrote | #2 |
| Changed in opensmtpd (Ubuntu Bionic): | |
| status: | Confirmed → Fix Released |
| Mike Salvatore (mikesalvatore) wrote | #3 |
| Changed in opensmtpd (Ubuntu Eoan): | |
| status: | Confirmed → Fix Released |
| Changed in opensmtpd (Debian): | |
| status: | Unknown → Fix Released |
My bad, I thought this was fixed by the sync, but it looks like it got caught up by the debian import freeze.