[Simon Walter] Bug#506353: mailscanner: many scripts allow local users to overwrite arbitrary files, and more, via symlink attacks

[Julian Field]

On 11/12/08 21:31, Kai Schaetzl wrote:
> @ecs.soton.ac.uk>
> Reply-To: mailscanner at lists.mailscanner.info
>
> Julian Field wrote on Thu, 11 Dec 2008 20:28:43 +0000:
>
>    
>> I have just released 4.74.6-2
>>      
>
> -rw-r--r-- 1 root root 4868907 Dec 11 15:02 MailScanner-4.74.6-
> 1.rpm.tar.gz
> -rw-r--r-- 1 root root 4868804 Dec 11 21:26 MailScanner-4.74.6-
> 2.rpm.tar.gz
>
> I see now that the "Could not test file ownership abilities" occurred more
> often than just on first restart. It didn't occur with this restart.
> Apart from that it seems to be working fine, with or without that error.
> I notice that both, MailScanner and the update wrapper, are writing to the
> lockfile (in this case clamavBusy.lock). Won't this create any problem?
> Or, as you seem to be writing line by line the current lock status, won't
> this slow down performance a bit? (write that line to it, search/find it,
> delete it ... for each batch).
>    
This is how it has always worked, I have just moved the lock files.
> Wait, it's still happening, it just took some time to get in the log:
> Dec 11 22:01:59 d01 MailScanner[15174]: Could not test file ownership
> abilities on
> /var/spool/MailScanner/incoming/Locks/MailScanner.ownertest.15174, please
> delete the file
>
> Somehow it doesn't seem to be able to confirm that the file is gone (it is
> gone!).
>    
The WorkArea.pm in my previous post will hopefully get rid of that.

Jules

-- 
Julian Field MEng CITP CEng
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

Need help customising MailScanner?
Contact me!
Need help fixing or optimising your systems?
Contact me!
Need help getting you started solving new requirements from your boss?
Contact me!

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654


-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.