Ubuntu Security Notice 4268-1 - It was discovered that OpenSMTPD incorrectly verified the sender's or receiver's e-mail addresses under certain conditions. An attacker could use this vulnerability to execute arbitrary commands as root.
fb1a4c6a7673d1e704ce5b14810da07fcd07eca7997ed43842b41e748c35f68a
==========================================================================
Ubuntu Security Notice USN-4268-1
February 05, 2020
OpenSMTPD vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 19.10
- Ubuntu 18.04 LTS
Summary:
OpenSMTPD could be made to run programs as root if it received specially
crafted input over the network.
Software Description:
- opensmtpd: secure, reliable, lean, and easy-to configure SMTP server
Details:
It was discovered that OpenSMTPD incorrectly verified the sender's or
receiver's e-mail addresses under certain conditions. An attacker could use
this vulnerability to execute arbitrary commands as root.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 19.10:
opensmtpd 6.0.3p1-6ubuntu0.1
Ubuntu 18.04 LTS:
opensmtpd 6.0.3p1-1ubuntu0.1
In general, a standard system update will make all the necessary changes.
References:
https://usn.ubuntu.com/4268-1
CVE-2020-7247
Package Information:
https://launchpad.net/ubuntu/+source/opensmtpd/6.0.3p1-6ubuntu0.1
https://launchpad.net/ubuntu/+source/opensmtpd/6.0.3p1-1ubuntu0.1