[Simon Walter] Bug#506353: mailscanner: many scripts allow local
users to overwrite arbitrary files, and more, via symlink attacks
MailScanner at ecs.soton.ac.uk
Thu Dec 11 14:16:06 GMT 2008
The final solution ended up being rather more secure than the version I
proposed yesterday, in order to avoid any possible extra privilege
escalation bugs, whereby a user could have "root" effects while only
getting "MailScanner Run As User" privileges.
Anyway, I have published my solution, version 4.74.6. I would be
grateful if you could test this and see if it works. All the -autoupdate
scripts and -wrapper scripts have been replaced, there is a new
"mailscanner_create_locks" script which is called automatically from a
couple of places for you, and there are quite a few changes inside
Please let me know what you think works and what still doesn't work, if
Julian Field MEng CITP CEng
Buy the MailScanner book at www.MailScanner.info/store
Need help customising MailScanner?
Need help fixing or optimising your systems?
Need help getting you started solving new requirements from your boss?
PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.
More information about the MailScanner