Releases Security Update (February 25, 2020)

Ref# OpenSMTPD | Date: Feb 25th 2020

On February 24, 2020 the OpenBSD Project released a security bulletin to address a remote code execution (RCE) vulnerability affecting versions 6.6.3p1 and below of its OpenSMTPD e-mail server software. By sending a specially-crafted email to an affected system, a remote actor can execute arbitrary shell commands as Root.

The portable version of OpenSMTPD is also vulnerable to exploitation. This version runs on the following operating systems and has been incorporated into many of them:

  • FreeBSD
  • NetBSD
  • DragonflyBSD
  • Max OS X
  • Various other Linux distributions.

It is recommended that you take the necessary precautions by ensuring your products are always updated.

For more information on this update, follow this URL:

OpenSMTPD 6.6.4p1 released: addresses CRITICAL vulnerability:

The Guyana National CIRT recommends users and administration to follow these updates and to apply them where necessary.