Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Thu, 21 May 2009 18:15:26 -0400 (EDT)
From: "Steven M. Christey" <>
To: Jamie Strandboge <>
Subject: Re: CVE Request: clamav-milter on Ubuntu

Assigned a while ago, sorry...

Name: CVE-2009-1601
Status: Candidate
Reference: CONFIRM:
Reference: UBUNTU:USN-770-1
Reference: URL:
Reference: BID:34818
Reference: URL:
Reference: SECUNIA:35000
Reference: URL:
Reference: XF:clamav-clamavmilter-security-bypass(50311)
Reference: URL:

The Ubuntu clamav-milter.init script in clamav-milter before
0.95.1+dfsg-1ubuntu1.2 in Ubuntu 9.04 sets the ownership of the
current working directory to the clamav account, which might allow
local users to bypass intended access restrictions via read or write
operations involving this directory.

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.