Problems MailScanner 4.78.17
MailScanner at ecs.soton.ac.uk
Thu Nov 26 13:57:30 GMT 2009
Well spotted. Fixed for the next release.
On 25/11/2009 16:57, ThB wrote:
> There's another small taint problem in Message.pm.
> It occured when scanning an eicar test virus.
> MailScanner's debugging output:
> In Debugging mode, not forking...
> Trying to setlogsock(native)
> INFO:: Meaningless output that goes nowhere, to keep SAVI happy
> Building a message batch to scan...
> Have a batch of 1 message.
> Insecure dependency in eval while running with -T switch at
> /opt/MailScanner/lib/MailScanner/Message.pm line 4372,<GEN65> line 1.
> -> at this point the MailScanner gets killed
> Code Snippet Message.pm
> 4369 $line =~ s/([\(\)\[\]\.\?\*\+\^"'@])/\\$1/g; # Escape any
> regex characters
> 4370 # Untainting joy...
> 4371 $line =~ $1 if $line =~ /(.*)/;
> 4372 $result = eval "\"$line\"";
> After checking& trying to understand the code, I think the problem is
> line 4371 which should be:
> 4371 $line = $1 if $line =~ /(.*)/;
> (note the "=" instead of "=~")
> After this modification my MailScanner 4.79.3-1 is perfectly running.
Julian Field MEng CITP CEng
Buy the MailScanner book at www.MailScanner.info/store
Need help customising MailScanner?
Need help fixing or optimising your systems?
Need help getting you started solving new requirements from your boss?
PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
Follow me at twitter.com/JulesFM and twitter.com/MailScanner
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.
More information about the MailScanner