Bogofilter Bogopass Insecure Temporary File Creation Vulnerability

Bugtraq ID:	6278
Class:	Access Validation Error
CVE:
Remote:	No
Local:	Yes
Published:	Nov 29 2002 12:00AM
Updated:	Nov 29 2002 12:00AM
Credit:	Discovery of this vulnerability credited to Matthias Andree <[email protected]>.
Vulnerable:	Bogofilter Email Filter 0.9 .0.4
Not Vulnerable:	Bogofilter Email Filter 0.9 .0.5 Bogofilter Email Filter 0.9 .0.3

Bogofilter Bogopass Insecure Temporary File Creation Vulnerability

Reportedly, bogopass creates temporary files in a predictable manner. As a result, it is possible for local attackers to read or corrupt files readable by the bogopass process. An attacker could potentially exploit this issue by creating a symbolic link in place of the temporary file which is created. Any actions performed by bogopass when it is executed will be performed on the file pointed to by the symbolic link.

Bogofilter Bogopass Insecure Temporary File Creation Vulnerability

No exploit is required.

Bogofilter Bogopass Insecure Temporary File Creation Vulnerability

Solution:
It has been reported that bogofilter 0.9.0.5 and later are not affected by this issue. Users are advised to upgrade as soon as possible.


Bogofilter Email Filter 0.9 .0.4

• Bogofilter Bogofilter 0.9.0.5
  http://sourceforge.net/project/showfiles.php?group_id=62265&release_id =118794

Bogofilter Bogopass Insecure Temporary File Creation Vulnerability

References:

• bogofilter contrib/bogopass temp file vulnerability (Matthias Andree )