DSA-4611: -1 opensmtpd -- security update
Published Jan 29, 2020
·Updated
opensmtpd - security update
Other sources
Qualys discovered that the OpenSMTPD SMTP server performed insufficient validation of email addresses which could result in the execution of arbitrary commands as root. In addition this update fixes a denial of service by triggering an opportunistic TLS downgrade.
Affected Software
2 affected components
debian/opensmtpd
debian/opensmtpd
Event History
Jan 29, 2020
Advisory Published
12:00 AM
Frequently Asked Questions
1
What access does an attacker need to exploit the command-execution flaw?
The issue is in validation of email addresses by the OpenSMTPD SMTP server. The provided information does not state that authentication or prior local access is required.
2
What privilege level could successful exploitation reach?
The insufficient email-address validation could result in execution of arbitrary commands as root.
3
What other impact is addressed by this update?
The update also fixes a denial-of-service issue that can be triggered through an opportunistic TLS downgrade.