CVE-2015-7687

Vulnerability

A use-after-free vulnerability exists in OpenSMTPD versions prior to 5.7.2, specifically in the req_ca_vrfy_smtp and req_ca_vrfy_mta functions. The flaw occurs when handling crafted SMTP commands that trigger improper memory management, allowing a remote attacker to exploit a freed memory region. This issue was discovered during a code audit by Qualys [1] and affects all versions before 5.7.2 [3].

Exploitation

An attacker can exploit this vulnerability remotely without any authentication or user interaction. By sending specially crafted SMTP commands to an affected OpenSMTPD server, the attacker triggers the use-after-free condition. The attack vector is over the network and requires no local access or prior privileges [1][4].

Impact

Successful exploitation allows an attacker to crash the OpenSMTPD daemon (denial of service) or execute arbitrary code with the privileges of the non-chrooted _smtpd user. This can lead to full compromise of the mail transfer agent, potentially enabling unauthorized access to emails or further lateral movement within the system [1][3].

Mitigation

The vulnerability was fixed in OpenSMTPD version 5.7.2, released on October 2, 2015 [3]. All users are strongly advised to upgrade to this version or later. For systems that cannot be updated immediately, network access to the SMTP service should be restricted to trusted hosts only. No other workarounds are documented in the available references [1][2][4].