news 28 Posted December 22, 2008 This is a multi-part message in MIME format... ------------=_1229976314-14940-6587 -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 _______________________________________________________________________ Mandriva Linux Security Advisory MDVA-2008:241 http://www.mandriva.com/security/ _______________________________________________________________________ Package : mailscanner Date : December 22, 2008 Affected: Corporate 4.0 _______________________________________________________________________ Problem Description: Local users can use symlink attacks throughout a flaw on trend-autoupdate script of MailScanner by using /tmp/opr.ini.##### or /tmp/lpt temporary file (CVE-2008-5140). Local users can use symlink attacks throughout flaws on clamav-autoupdate, panda-autoupdate and rav-autoupdate scripts of MailScanner by using ClamAV.update.log, pav.zip and RavBusy.lock temporary files (CVE-2008-5312). Local users can use symlink attacks throughout flaws on kaspersky-wrapper, bitdefender-wrapper, rav-wrapper scripts and Quarentine.pm, TNEF.pm, SA.pm, WorkArea.pm MailScanner perl modules by using kavoutput.tmp.27073, log.bdc.27073, report.vir.27073, MailScanner.ownertest.27073, tnef.27073 and MS.bayes.rebuild.lock temporary files (CVE-2008-5313). Further MailScanner had symlink flaws on antivir-autoupdate, bitdefender-autoupdate, clamav-autoupdate, etrust-autoupdate, generic-autoupdate, inoculan-autoupdate, kaspersky-autoupdate, nod32-autoupdate, norman-autoupdate, rav-autoupdate, sophos-autoupdate, symscanengine-autoupdate, vexira-autoupdate, f-prot-autoupdate and css-autoupdate scripts under following temporary vulnerable files: AntiVirBusy.lock, BitDefenderBusy.lock, ClamAVBusy.lock, eTrustBusy.lock, GenericBusy.lock, InoculanBusy.lock, KasperskyBusy.lock, Nod32Busy.lock, NormanBusy.lock, RavBusy.lock, SophosBusy.lock, SymScanEngineBusy.lock, VexiraBusy.lock, FProtBusy.lock and SYMCScan.lock. This update provides fix for all symlink flaws described on this security advisory. _______________________________________________________________________ References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5140 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5312 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5313 _______________________________________________________________________ Updated Packages: Corporate 4.0: 4e93bc7c48ec8f65122d263237b99ec9 corporate/4.0/i586/mailscanner-4.55.9_1-3.1.20060mlcs4.noarch.rpm f92acdbed4f63778609726eaa2dc8fd1 corporate/4.0/i586/mailscanner-spamassassin-4.55.9_1-3.1.20060mlcs4.noarch.rpm 35f1b7e0cc1534def4394e7bec95ab48 corporate/4.0/SRPMS/mailscanner-4.55.9_1-3.1.20060mlcs4.src.rpm Corporate 4.0/X86_64: 4e93bc7c48ec8f65122d263237b99ec9 corporate/4.0/x86_64/mailscanner-4.55.9_1-3.1.20060mlcs4.noarch.rpm f92acdbed4f63778609726eaa2dc8fd1 corporate/4.0/x86_64/mailscanner-spamassassin-4.55.9_1-3.1.20060mlcs4.noarch.rpm 35f1b7e0cc1534def4394e7bec95ab48 corporate/4.0/SRPMS/mailscanner-4.55.9_1-3.1.20060mlcs4.src.rpm _______________________________________________________________________ To upgrade automatically use MandrivaUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you. All packages are signed by Mandriva for security. You can obtain the GPG public key of the Mandriva Security Team by executing: gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98 You can view other update advisories for Mandriva Linux at: http://www.mandriva.com/security/advisories If you want to report vulnerabilities, please contact security_(at)_mandriva.com _______________________________________________________________________ Type Bits/KeyID Date User ID pub 1024D/22458A98 2000-07-10 Mandriva Security Team -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.9 (GNU/Linux) iD8DBQFJT8jcmqjQ0CJFipgRArRHAKDH4O/m1AfoakbcAK7monhnYH5eywCg8m1k OPwl0ksaHvGa9rLs78PtnwQ= =St+b -----END PGP SIGNATURE----- ------------=_1229976314-14940-6587 Content-Type: text/plain; name="message-footer.txt" Content-Disposition: inline; filename="message-footer.txt" Content-Transfer-Encoding: 8bit To unsubscribe, send a email to sympa ( -at -) mandrivalinux.org with this subject : unsubscribe security-announce _______________________________________________________ Want to buy your Pack or Services from Mandriva? Go to http://www.mandrivastore.com Join the Club : http://www.mandrivaclub.com _______________________________________________________ ------------=_1229976314-14940-6587-- Share this post Link to post
