OS Command Injection in spamassassin (Alpine package)

1) OS Command Injection

EUVDB-ID: #VU23601

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-11805

CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Exploit availability: No

Description

The vulnerability allows a local user to execute arbitrary shell commands on the target system.

The vulnerability exists due to nefarious CF files can be configured to run system commands without any output. A local user can inject arbitrary commands into nefarious CF files and compromise the system or execute arbitrary code with elevated privileges.

Mitigation

Install update from vendor's website.

Vulnerable software versions

spamassassin (Alpine package): 3.4.0-r0 - 3.4.2-r5

External links

http://git.alpinelinux.org/aports/commit/?id=3fe10202b17cab6dd2b9eefd7e8e092864a008ab
http://git.alpinelinux.org/aports/commit/?id=414d938b62bf425063a54567a1736a0d2fb76c8f
http://git.alpinelinux.org/aports/commit/?id=4f41af115f2fe395e2de01e5ee07a53dbbfa38a1
http://git.alpinelinux.org/aports/commit/?id=baee0facb0bff1fa120bd6c9b7b0454af79a3f04
http://git.alpinelinux.org/aports/commit/?id=d41a153ca51fae77177652bcf56edc463802bab3

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.