oss-security - Re: CVE Request: clamav-milter on Ubuntu

Openwall Project		/home Owl JtR Pro crypt pam_passwdqc tcb phpass scanlogd popa3d msulogin / Linux BIND / advisories presentations / services donations / wordlists passwords / news community lists wiki CVSweb mirrors signatures
bringing security into open environments

Password Recovery Resources on the Net

[<prev] [next>] [<thread-prev] [month] [year] [list]

Date: Thu, 21 May 2009 18:15:26 -0400 (EDT)
From: "Steven M. Christey" <coley@...us.mitre.org>
To: Jamie Strandboge <jamie@...onical.com>
cc: coley@...us.mitre.org, oss-security@...ts.openwall.com
Subject: Re: CVE Request: clamav-milter on Ubuntu

Assigned a while ago, sorry...

======================================================
Name: CVE-2009-1601
Status: Candidate
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1601
Reference: CONFIRM:https://launchpad.net/bugs/365823
Reference: UBUNTU:USN-770-1
Reference: URL:http://www.ubuntu.com/usn/USN-770-1
Reference: BID:34818
Reference: URL:http://www.securityfocus.com/bid/34818
Reference: SECUNIA:35000
Reference: URL:http://secunia.com/advisories/35000
Reference: XF:clamav-clamavmilter-security-bypass(50311)
Reference: URL:http://xforce.iss.net/xforce/xfdb/50311

The Ubuntu clamav-milter.init script in clamav-milter before
0.95.1+dfsg-1ubuntu1.2 in Ubuntu 9.04 sets the ownership of the
current working directory to the clamav account, which might allow
local users to bypass intended access restrictions via read or write
operations involving this directory.

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.