CVE:CVE-2008-5312
CNNVD:CNNVD-200812-032
MailScanner是一个Email病毒扫描、防黑和垃圾邮件过滤程序。
mailscanner 4.55.10版本及其它4.74.16-1之前的版本可能允许本地用户借助对被(1) f-prot-autoupdate, (2) clamav-autoupdate, (3) panda-autoupdate.new, (4) trend-autoupdate.new, 和(5)/etc/MailScanner/autoupdate/中的 rav-autoupdate.new 脚本所运行的某临时文件上发动一个symlink攻击 ,来重写任意文件。该漏洞不同于CVE-2008-5140。
solution:Upgrade mailscanner mailscanner to a higher version than 4.55.10,4.56.8-1,4.57.7-1,4.58.9-1,4.59.4-2,4.60.8-1,4.61.7-2,4.62.9-3,4.63.8-1,4.64.3-2,4.65.3-1,4.66.5-3,4.67.6-1,4.68.8,4.68.8-1,4.69.9-3,4.70.7-1,4.71.10-1,4.72.5-1,4.73.4-2,and avoid the version 4.55.10,4.56.8-1,4.57.7-1,4.58.9-1,4.59.4-2,4.60.8-1,4.61.7-2,4.62.9-3,4.63.8-1,4.64.3-2,4.65.3-1,4.66.5-3,4.67.6-1,4.68.8,4.68.8-1,4.69.9-3,4.70.7-1,4.71.10-1,4.72.5-1,4.73.4-2