FYI…

- http://isc.sans.org/diary.php?storyid=1385
Last Updated: 2006-06-06 19:14:20 UTC
"…Spamassassin* has 2 new releases out. They fix vulnerabilities that -given specific command line options- opens up spamassassin to remote command execution as the user spamassassin is running as.
Solution: upgrade** to version 3.06 or 3.1.3 as soon as possible or do not use the vulnerable command line combination (aparently both "–vpopmail" and "-P" (paranoid) need to be turned on) as a workaround…"

* http://spamassassin.apache.org/

** http://spamassassin.apache.org/downloads.c…te=200606050750

:ph34r: