arbitrary command execution vulnerability

[Ryan Kavanagh]

OpenBSD 6.6 errata 021, February 24, 2020:

An out of bounds read in smtpd allows an attacker to inject arbitrary
commands into the envelope file which are then executed as root.
Separately, missing privilege revocation in smtpctl allows arbitrary
commands to be run with the _smtpq group.

This affects Debian versions since 5.7.3p2 (released upstream
2016-02-02). In particular, every Ubuntu release since xenial is affected.
Quoting from the advisory:

    This vulnerability, an out-of-bounds read introduced in December
    2015 (commit 80c6a60c, "when peer outputs a multi-line response
    ..."), is exploitable remotely and leads to the execution of
    arbitrary shell commands: either as root, after May 2018 (commit
    a8e22235, "switch smtpd to new grammar"); or as any non-root user,
    before May 2018.

https://www.openwall.com/lists/oss-security/2020/02/24/5

The other advisory fixed by the patches does not appear to affect
Debian because /proc/sys/fs/protected_hardlinks is 1 by default:

https://www.openwall.com/lists/oss-security/2020/02/24/4

[Ryan Kavanagh (ryanakca)]

My bad, I thought this was fixed by the sync, but it looks like it got caught up by the debian import freeze.

[Mike Salvatore (mikesalvatore)]

Released 6.0.3p1-1ubuntu0.2 for bionic.

[Mike Salvatore (mikesalvatore)]

Released 6.0.3p1-6ubuntu0.2 for eoan