Bug 606231

Summary: Spamassassin still uses openwhois tests, a squatted domain.
Product: [openSUSE] openSUSE 11.3 Reporter: Carlos Robinson <carlos.e.r>
Component: NetworkAssignee: Peter Varkoly <varkoly>
Status: RESOLVED FIXED QA Contact: E-mail List <qa-bugs>
Severity: Critical    
Priority: P2 - High CC: bugz57, pth, radmanic, security-team, suse-beta
Version: Final   
Target Milestone: ---   
Hardware: Other   
OS: openSUSE 11.2   
Whiteboard: maint:released:11.1:36199 maint:released:11.2:36199 maint:released:sle11-sp1:37702 maint:released:sle10-sp3:37703
Found By: --- Services Priority:
Business Priority: Blocker: ---
Marketing QA Status: --- IT Deployment: ---
Deadline: 2010-10-26   

Description Carlos Robinson 2010-05-16 00:31:01 UTC
Mail is wrongly tagged as spam by those tests. Affects at least 11.0 to 11.2. Bug was solved upstream last July.

 Bug 6157 - remove open-whois.org rules since domain is cybersquatted
https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6157

linux.debian.bugs.dist
Bug#537477: spamassassin: Remove open-whois.org as it is cybersquatted 
http://groups.google.com/group/linux.debian.bugs.dist/browse_thread/thread/490c97eb62641887

http://www.dnsbl.com/2009/08/status-of-blopen-whoisorg-dead.html
Status of bl.open-whois.org: DEAD
Posted by Al Iverson on Tuesday, August 18, 2009 


Classified as "security", public, because I understand that spamassassin is a security component of the distro.
Comment 1 Thomas Biege 2010-05-17 11:31:39 UTC
reassigned to maintainer

I will put it on the list of planned updates.
Comment 2 Peter Varkoly 2010-05-17 11:41:24 UTC
We need update for:
SLES10-SP3 SLE11 SLE11-SP1 11.1 11.2
Comment 4 Marcus Meissner 2010-05-17 13:05:41 UTC
how large is the impact?

how much of a rating can this test give?
Comment 5 Peter Varkoly 2010-05-17 16:38:12 UTC
That are the scores of whois rules:

3.51 WHOIS_AITPRIV
2.84 WHOIS_UNLISTED
2.70 WHOIS_SECUREWHOIS
2.70 WHOIS_CONTACTPRIV
2.60 WHOIS_MONIKER_PRIV
2.02 WHOIS_WHOISGUARD
1.65 WHOIS_REGISTERFLY
1.50 WHOIS_PRIVPROT
1.50 WHOIS_MYPRIVREG
1.41 WHOIS_NAMEKING
1.00 WHOIS_WHOISPROT
1.00 WHOIS_SAFENAMES
1.00 WHOIS_REGTEK
1.00 WHOIS_REGISTER4LESS
1.00 WHOIS_PRIVDOMAIN
1.00 WHOIS_NOMINET
1.00 WHOIS_NETID
1.00 WHOIS_FINEXE
1.00 WHOIS_DYNADOT
1.00 WHOIS_DREAMPRIV
1.00 WHOIS_DOMPRIVCORP
1.00 WHOIS_DOMESCROW


If the user runs periodically sa-update (which is recommended) there is no problem. 
http://www.dnsbl.com/2009/08/status-of-blopen-whoisorg-dead.html
Comment 6 Carlos Robinson 2010-05-17 20:23:33 UTC
(In reply to comment #5)

> If the user runs periodically sa-update (which is recommended) there is no
> problem. 
> http://www.dnsbl.com/2009/08/status-of-blopen-whoisorg-dead.html

Recommended by whom? Not by SUSE/Novell.

"users" do not run sa-update. We rely on "YOU" (YaST) for doing our updates. Or, we could rely on a system service, like /etc/init.d/fresclam to do the updates to the virus dababase - but such a system service does not exist for SA.

Mail administrators and some users *may* run sa-update.



(In reply to comment 2)

> We need update for:
> SLES10-SP3 SLE11 SLE11-SP1 11.1 11.2

11.0 is affected and still officially supported, AFAIK.
Comment 7 Peter Varkoly 2010-06-24 10:17:42 UTC
*** Bug 615250 has been marked as a duplicate of this bug. ***
Comment 8 Carlos Robinson 2010-09-25 19:45:45 UTC
Ping!

Still undone.
Comment 10 Ludwig Nussel 2010-09-27 11:53:24 UTC
not really a security vulnerability and no other security update can be used as driver. Needs to be handles as regular maintenance update.
Comment 11 Peter Varkoly 2010-09-28 10:13:12 UTC
I've submitted all packages. Please start mainenance
Comment 12 Swamp Workflow Management 2010-09-28 12:31:43 UTC
The SWAMPID for this issue is 36123.
This issue was rated as low.
Please submit fixed packages until 2010-10-26.
Also create a patchinfo file using this link:
https://swamp.suse.de/webswamp/wf/36123
Comment 13 Christian Dengler 2010-09-28 12:32:36 UTC
As it is annoying for the customers (which doesn't use sa-update), update started now.
Comment 16 Dirk Mueller 2010-10-01 11:26:41 UTC
correct. Can you please submit packages that contain the complete "sa-update" diff, not just this one fix please?

Thanks,
Comment 17 Peter Varkoly 2010-10-04 07:01:56 UTC
I think the best solution is to make a daily cronjob which runs sa-update.
Is it OK?
Comment 18 Dirk Mueller 2010-10-04 08:46:48 UTC
that would be also okay.
Comment 19 Dirk Mueller 2010-10-04 08:47:18 UTC
note that those who use sa-compile (I do), also need to run sa-compile after sa-update.
Comment 20 Ludwig Nussel 2010-10-04 09:24:37 UTC
the cron job shouldn't be enabled by default though IMO. Just as spamd isn't enabled by default.
Comment 30 Dirk Mueller 2010-11-16 22:00:33 UTC
updates ready for QA, resolving Bug.
Comment 31 Swamp Workflow Management 2010-12-16 13:28:54 UTC
Update released for: perl-spamassassin, spamassassin, spamassassin-debuginfo, spamassassin-debugsource
Products:
openSUSE 11.1 (debug, i586, ppc, x86_64)
openSUSE 11.2 (debug, i586, x86_64)
Comment 32 Swamp Workflow Management 2010-12-16 15:58:55 UTC
Update released for: perl-spamassassin, spamassassin, spamassassin-debuginfo, spamassassin-debugsource
Products:
SLE-DEBUGINFO 11-SP1 (i386, ia64, ppc64, s390x, x86_64)
SLE-DESKTOP 11-SP1 (i386, x86_64)
SLE-SERVER 11-SP1 (i386, ia64, ppc64, s390x, x86_64)
SLES4VMWARE 11-SP1 (i386, x86_64)
Comment 33 Christian Boltz 2010-12-17 23:41:38 UTC
I just installed the patch on a 11.1 server, with the result that Amavis died instantly after startup :-(

The log says:
Dec 18 00:29:41 srv amavis[26790]: SpamControl: initializing Mail::SpamAssassin
Dec 18 00:29:42 srv amavis[26790]: (!!)TROUBLE in pre_loop_hook: check: no 
    loaded plugin implements 'check_main': cannot scan! at 
    /usr/lib/perl5/vendor_perl/5.10.0/Mail/SpamAssassin/PerMsgStatus.pm 
    line 164.
Dec 18 00:29:42 srv amavis[26790]: (!)_DIE: check: no loaded plugin implements 
    'check_main': cannot scan! at 
    /usr/lib/perl5/vendor_perl/5.10.0/Mail/SpamAssassin/PerMsgStatus.pm line 164.

(Amavis works again after downgrading to perl-spamassassin-3.2.5-26.9.1)
Comment 34 Christian Boltz 2010-12-19 11:12:19 UTC
bug 660431 contains more details about the reason of the failure.
Comment 35 Swamp Workflow Management 2010-12-29 21:54:27 UTC
Update released for: perl-spamassassin, spamassassin, spamassassin-debuginfo
Products:
SLE-DESKTOP 10-SP3 (i386, x86_64)
SLE-SAP-APL 10-SP3 (x86_64)
SLE-SERVER 10-SP3 (i386, ia64, ppc, s390x, x86_64)
Comment 36 Dirk Mueller 2010-12-30 14:01:44 UTC
sa-update support is missing for 11.3. please submit a fixed package.
Comment 39 Dirk Mueller 2011-01-19 09:13:34 UTC
submitted the factory package now myself.
Comment 40 Bernhard Wiedemann 2016-04-15 11:44:59 UTC
This is an autogenerated message for OBS integration:
This bug (606231) was mentioned in
https://build.opensuse.org/request/show/50120 11.2:Test / spamassassin
https://build.opensuse.org/request/show/50121 11.1 / spamassassin