oss-sec mailing list archives
Re: CVE Request: clamav-milter on Ubuntu
From: "Steven M. Christey" <coley () linus mitre org>
Date: Thu, 21 May 2009 18:15:26 -0400 (EDT)
Assigned a while ago, sorry... ====================================================== Name: CVE-2009-1601 Status: Candidate URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1601 Reference: CONFIRM:https://launchpad.net/bugs/365823 Reference: UBUNTU:USN-770-1 Reference: URL:http://www.ubuntu.com/usn/USN-770-1 Reference: BID:34818 Reference: URL:http://www.securityfocus.com/bid/34818 Reference: SECUNIA:35000 Reference: URL:http://secunia.com/advisories/35000 Reference: XF:clamav-clamavmilter-security-bypass(50311) Reference: URL:http://xforce.iss.net/xforce/xfdb/50311 The Ubuntu clamav-milter.init script in clamav-milter before 0.95.1+dfsg-1ubuntu1.2 in Ubuntu 9.04 sets the ownership of the current working directory to the clamav account, which might allow local users to bypass intended access restrictions via read or write operations involving this directory.
Current thread:
- CVE Request: clamav-milter on Ubuntu Jamie Strandboge (May 01)
- Re: CVE Request: clamav-milter on Ubuntu Steven M. Christey (May 21)