diff options
| author | Jacques Vidrine <nectar@FreeBSD.org> | 2004-10-19 16:40:34 +0000 |
|---|---|---|
| committer | Jacques Vidrine <nectar@FreeBSD.org> | 2004-10-19 16:40:34 +0000 |
| commit | 91d7cbe48c065a0256a462e80cd860a040291307 (patch) | |
| tree | 7e0ac6694a286bc21a6fee282b3c794c007c7da9 /security/vuxml/vuln.xml | |
| parent | 8ac3957ed96f7b32b5a91061eab927cb27d11630 (diff) | |
| download | ports-91d7cbe48c065a0256a462e80cd860a040291307.tar.gz ports-91d7cbe48c065a0256a462e80cd860a040291307.zip | |
Document a vulnerability in ifmail. (There does not exist
an appropriate public reference yet--- this entry should be
updated when the port is updated.)
Reported by: Niels Heinen <niels.heinen@ubizen.com>
Notes
Notes:
svn path=/head/; revision=119800
Diffstat (limited to 'security/vuxml/vuln.xml')
| -rw-r--r-- | security/vuxml/vuln.xml | 25 |
1 files changed, 25 insertions, 0 deletions
diff --git a/security/vuxml/vuln.xml b/security/vuxml/vuln.xml index 83717c37cd30..97c1ae9d1e2b 100644 --- a/security/vuxml/vuln.xml +++ b/security/vuxml/vuln.xml @@ -32,6 +32,31 @@ EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. --> <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1"> + <vuln vid="746ca1ac-21ec-11d9-9289-000c41e2cdad"> + <topic>ifmail -- unsafe set-user-ID application</topic> + <affects> + <package> + <name>ifmail</name> + <range><le>ifmail-2.15_4</le></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml"> + <p>Niels Heinen reports that ifmail allows one to specify + a configuration file. Since ifmail runs set-user-ID `news', + this may allow a local attacker to write to arbitrary files + or execute arbitrary commands as the `news' user.</p> + </body> + </description> + <references> + <url>http://cvsweb.freebsd.org/ports/news/ifmail</url> + </references> + <dates> + <discovery>2004-08-23</discovery> + <entry>2004-10-19</entry> + </dates> + </vuln> + <vuln vid="e31d44a2-21e3-11d9-9289-000c41e2cdad"> <topic>imwheel -- insecure handling of PID file</topic> <affects> |