group.of.nepali.translators team mailing list archive

[Mike Salvatore <1864707@xxxxxxxxxxxxxxxxxx>]

Released 6.0.3p1-1ubuntu0.2  for bionic.

** Changed in: opensmtpd (Ubuntu Bionic)
       Status: Confirmed => Fix Released

-- 
You received this bug notification because you are a member of नेपाली
भाषा समायोजकहरुको समूह, which is subscribed to Xenial.
Matching subscriptions: Ubuntu 16.04 Bugs
https://bugs.launchpad.net/bugs/1864707

Title:
  arbitrary command execution vulnerability

Status in opensmtpd package in Ubuntu:
  Confirmed
Status in opensmtpd source package in Xenial:
  Confirmed
Status in opensmtpd source package in Bionic:
  Fix Released
Status in opensmtpd source package in Eoan:
  Fix Released
Status in opensmtpd package in Debian:
  Unknown

Bug description:
  OpenBSD 6.6 errata 021, February 24, 2020:

  An out of bounds read in smtpd allows an attacker to inject arbitrary
  commands into the envelope file which are then executed as root.
  Separately, missing privilege revocation in smtpctl allows arbitrary
  commands to be run with the _smtpq group.

  This affects Debian versions since 5.7.3p2 (released upstream
  2016-02-02). In particular, every Ubuntu release since xenial is affected.
  Quoting from the advisory:

      This vulnerability, an out-of-bounds read introduced in December
      2015 (commit 80c6a60c, "when peer outputs a multi-line response
      ..."), is exploitable remotely and leads to the execution of
      arbitrary shell commands: either as root, after May 2018 (commit
      a8e22235, "switch smtpd to new grammar"); or as any non-root user,
      before May 2018.

  https://www.openwall.com/lists/oss-security/2020/02/24/5

  The other advisory fixed by the patches does not appear to affect
  Debian because /proc/sys/fs/protected_hardlinks is 1 by default:

  https://www.openwall.com/lists/oss-security/2020/02/24/4

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/opensmtpd/+bug/1864707/+subscriptions