Ejabberd : Symlink vulnerability during installation process

["Julien L." <jlanthea () hotmail com>]

Date                : 2006-04-25
Vendor              : www.process-one.net
Products            : ejabberd binary installation for Linux
Vulnerable Versions : 1.1.1_1 and prior versions


When root user is running ejabberd-1.1.1_1-linux-installer.bin (in
order to install the Jabber server ejabberd). It creates in an insecure mode 
a file named bitrock_installer.log in the /tmp directory.

Local users are abble to perform a symlink attack and then cause
a DoS on the local machine.

_________________________________________________________________
FREE pop-up blocking with the new MSN Toolbar - get it now! 
http://toolbar.msn.click-url.com/go/onm00200415ave/direct/01/