Multiple vulnerabilities in OpenSMTPD

Published: 2023-06-19

Risk	Medium
Patch available	YES
Number of vulnerabilities	2
CVE-ID	N/A
CWE-ID	CWE-399 CWE-125
Exploitation vector	Network
Public exploit	N/A
Vulnerable software Subscribe	OpenSMTPD Server applications / Mail servers
Vendor	OpenBSD

Security Bulletin

This security bulletin contains information about 2 vulnerabilities.

1) Resource management error

EUVDB-ID: #VU77500

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: N/A

CWE-ID: CWE-399 - Resource Management Errors

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper management of internal resources in smtpd(8) when handling connections from a local, scoped ipv6 address. A local user can send commands to the SMTP server and perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

OpenSMTPD: 6.0.0 - 6.8.0p2

External links

http://github.com/OpenSMTPD/OpenSMTPD/releases/tag/7.3.0p0

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Out-of-bounds read

EUVDB-ID: #VU77501

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]