sa-exim Greylisting.pm vulnerability

[Henrik Krohns]

Hello from SpamAssassin project,

For reference, check this discussion: https://marc.info/?t=157668107800004&r=1&w=2

Greylisting.pm module provided by sa-exim uses unsafe eval for config string.

Anyone capable of writing .cf files/rules can run perl code and commands even as root, if spamd/spamassassin is started as root.

Example SpamAssassin rule:

header GREYLIST eval:greylisting("( 'hacked' => `touch /tmp/hacked && echo 1`; 'dir' => '/var/spool/sa-exim/tuplets'; 'method' => 'dir'; 'greylistsecs' => '1800'; 'dontgreylistthreshold' => 10; 'connectiphdr' => 'X-SA-Exim-Connect-IP'; 'envfromhdr' => 'X-SA-Exim-Mail-From'; 'rcpttohdr' => 'X-SA-Exim-Rcpt-To'; 'greylistnullfrom' => 1; 'greylistfourthbyte' => 0 )")

Notice one of many ways to inject commands into eval
  'hacked' => `touch /tmp/hacked && echo 1`;

This will create /tmp/hacked file immediately as the user which starts spamd or spamassassin command, and will not create any suspicious output or warnings to user.

These kinds of bugs are nasty, as people might have automatic downloads of external .cf files from third parties and never notice someone abusing things through this.

The bug is mitigated in SpamAssassin 3.4.3, which properly taints configuration strings, and results in Perl complaining and not loading Greylisting.pm at all.

I have attached a patch that maintains backwards compatibility and safely parses the config string, and of course allows the plugin to work with 3.4.3. :-)

[Henrik Krohns (hegeli)]

Revised patch attached (previous missed untaint).

In case you use Debian sa-exim as upstream, I've also posted this to https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=946829

[Alex Murray (alexmurray)]

This is public as per https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=946829

[Ubuntu Foundations Team Bug Bot (crichton)]

The attachment "greylisting.diff" seems to be a patch. If it isn't, please remove the "patch" flag from the attachment, remove the "patch" tag, and if you are a member of the ~ubuntu-reviewers, unsubscribe the team.

[This is an automated message performed by a Launchpad user owned by ~brian-murray, for any issues please contact him.]