------- You are receiving this mail because: ------- You are on the CC list for the bug.
http://bugs.exim.org/show_bug.cgi?id=989 --- Comment #1 from Nigel Metheringham <[email protected]> 2010-05-26 13:29:49 --- [Comments from Phil Pennock] The second is a symlink attack against /tmp -- so if you're on a sane system which inhibits following symlinks in /tmp then you're protected. Eg, BSD 'nosymfollow' option on the mountpoint. The exposure is that an empty file can be created as the attacked user, or an fcntl exclusive lock can be taken out against an existing file. Mitigation strategies: * don't use MBX with it's dependency upon /tmp * mount /tmp with symlinks disabled -- Configure bugmail: http://bugs.exim.org/userprefs.cgi?tab=email -- ## List details at http://lists.exim.org/mailman/listinfo/exim-dev Exim details at http://www.exim.org/ ##
