On Thu, 10 Feb 2011, Michael Scheidell wrote:
<http://seclists.org/fulldisclosure/2010/Mar/140> <http://www.securityfocus.com/bid/38578> Vulnerable: SpamAssassin Milter Plugin SpamAssassin Milter Plugin 0.3.1 I don't see anything on bugtraq about a fix.
The securityfocus page lists some Debian fixes. The Debian patch spamass-milter_0.3.1-8+lenny2.diff.gz changelog includes:
+spamass-milter (0.3.1-8+lenny1) stable-security; urgency=high + + * Use new popenenv function instead of open; fixes remote code exploit + as the spamass-milter user when run using -x. (closes: #573228) + + -- Don Armstrong <d...@debian.org> Wed, 17 Mar 2010 12:52:56 -0700 per http://security.debian.org/pool/updates/main/s/spamass-milter/ -- Andrew Daviel, TRIUMF, Canada Tel. +1 (604) 222-7376 (Pacific Time) Network Security Manager
