[security-alerts] FW: [SA25315] Amavis Zoo Denial of Service Vulnerability

["Kazennov, Vladimir" <Vladimir.Kazennov@xxxxxxxxxx>]

> ----------------------------------------------------------------------
> 
> TITLE:
> Amavis Zoo Denial of Service Vulnerability
> 
> SECUNIA ADVISORY ID:
> SA25315
> 
> VERIFY ADVISORY:
> http://secunia.com/advisories/25315/
> 
> CRITICAL:
> Less critical
> 
> IMPACT:
> DoS
> 
> WHERE:
> From remote
> 
> SOFTWARE:
> AMaViS (A Mail Virus Scanner) 0.x
> http://secunia.com/product/2468/
> amavisd-new 2.x
> http://secunia.com/product/4492/
> 
> DESCRIPTION:
> A vulnerability has been reported in Amavis, which can potentially be
> exploited by malicious people to cause a DoS (Denial of Service).
> 
> The vulnerability is caused due to Amavis potentially invoking an
> insecure version of zoo or unzoo. This can be exploited to cause an
> infinite loop resulting in high CPU utilisation.
> 
> SOLUTION:
> The vendor recommends disabling the use of zoo or unzoo, or using a
> patched version of zoo.
> 
> PROVIDED AND/OR DISCOVERED BY:
> The vendor credits Jean-Sebastien Guay-Leroux.
> 
> ORIGINAL ADVISORY:
> http://www.amavis.org/security/asa-2007-2.txt
>