[Simon Walter] Bug#506353: mailscanner: many scripts allow local users to overwrite arbitrary files, and more, via symlink attacks

[Julian Field]

The final solution ended up being rather more secure than the version I 
proposed yesterday, in order to avoid any possible extra privilege 
escalation bugs, whereby a user could have "root" effects while only 
getting "MailScanner Run As User" privileges.

Anyway, I have published my solution, version 4.74.6. I would be 
grateful if you could test this and see if it works. All the -autoupdate 
scripts and -wrapper scripts have been replaced, there is a new 
"mailscanner_create_locks" script which is called automatically from a 
couple of places for you, and there are quite a few changes inside 
MailScanner too.

Please let me know what you think works and what still doesn't work, if 
anything.

Thanks!

Jules

-- 
Julian Field MEng CITP CEng
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

Need help customising MailScanner?
Contact me!
Need help fixing or optimising your systems?
Contact me!
Need help getting you started solving new requirements from your boss?
Contact me!

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654


-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.