Bug Tracker item #2932993, was opened at 2010-01-15 18:34
Message generated for change (Comment added) made by sbajic
You can respond by visiting:
https://sourceforge.net/tracker/?func=detail&atid=1126467&aid=2932993&group_id=250683
Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: daemon
Group: v3.9.0
Status: Open
Resolution: None
Priority: 9
Private: No
Submitted By: Enrico Scholz (ensc)
Assigned to: Stevan Bajic (sbajic)
Summary: Path traversal vulnerability
Initial Comment:
$ dspamc --classify --user ../../../../../../etc -- < /tmp/sp
# strace -f `pidof dspamd`
stat64("/var/lib/dspam/data/././../../../../../..", {st_mode=S_IFDIR|0755,
st_size=4096, ...}) = 0
...
# ll /
-rw-rw---- 1 root mail 1573112 15. Jan 18:24 etc.css
-rw-rw---- 1 root mail 0 15. Jan 18:24 etc.lock
-rw-rw---- 1 root mail 12 15. Jan 18:24 etc.stats
-------
'dspam' should do some sanity checks regarding the username. Trusting e.g.
into the MTA that only valid usernames are submitted does not suffice because
there are dozens of ways how 'dspam' can be invoked and they can not be
verified all.
Measure like non-root execution of 'dspamd' can lower the impact of this attack
but I would not trust on it either.
----------------------------------------------------------------------
>Comment By: Stevan Bajic (sbajic)
Date: 2010-01-19 13:38
Message:
Hallo Enrico
any news regarding the attached patch?
--
Kind Regards from Switzerland,
Stevan Bajić
----------------------------------------------------------------------
Comment By: Stevan Bajic (sbajic)
Date: 2010-01-18 16:26
Message:
Hallo Enrico Scholz
Could you try the attached patch?
--
Kind Regards from Switzerland,
Stevan Bajić
----------------------------------------------------------------------
You can respond by visiting:
https://sourceforge.net/tracker/?func=detail&atid=1126467&aid=2932993&group_id=250683
------------------------------------------------------------------------------
Throughout its 18-year history, RSA Conference consistently attracts the
world's best and brightest in the field, creating opportunities for Conference
attendees to learn about information security's most important issues through
interactions with peers, luminaries and emerging and established companies.
http://p.sf.net/sfu/rsaconf-dev2dev
_______________________________________________
Dspam-devel mailing list
Dspam-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/dspam-devel
