Tim Jackson wrote: > Although not in any remotely default configuration, it could effectively > be in some setups, where generation of domainlists (or whatever) was > scripted, and some of that data ultimately came from user input. I bet > lots of people have exim_dbmbuild called in scripts one way or another. > Sure, some input sanity checking should happen further up the chain, but > nonetheless the problem probably should be fixed.
The bug is in handling the name of the DB file, not the data which gets into the file. Specifying a very long file name will crash the program. DOH :) Granted, it IS a bug, but the whole tone of the posting smells like "I found a major security issue, answer NOW or I'll post it on bugtraq". /tom
smime.p7s
Description: S/MIME Cryptographic Signature
-- ## List details at http://www.exim.org/mailman/listinfo/exim-dev Exim details at http://www.exim.org/ ##
