SpamAssassin-milter has a remote root vulnerability

SpamAssassin-milter plugs SpamAssassin into mail agents which speak the "milter" protocol. It is, evidently, trivially easy to get this plugin to execute commands as root when it is used with Postfix in some configurations, and possibly with other mailers as well. There is a bug tracker entry where progress on a patch can be followed; the developers seem to not be in a great hurry, despite the fact that exploits are circulating. Sites using SpamAssassin-milter should probably just disable it for now. (Thanks to Christof Damian).

Comments (6 posted)