sys-apps/file vulnerability !!

Klavs · Guru Joined: 22 May 2002 Posts: 536 Location: Denmark

Hi guys,

see this: http://www.securityfocus.org/archive/1/313837/2003-03-02/2003-03-08/0

I can see on file's homepage that the newest version is v3.41 - and as this vulnerability only goes for v3.39 and older - I'm suggesting we get an updated ebuild out

_________________
Best regards,

Klavs Klavsen
Denmark

Working with Unix is like wrestling a worthy opponent.
Working with windows is like attacking a small whining child
who is carrying a .38.

Klavs · Guru Joined: 22 May 2002 Posts: 536 Location: Denmark

Oh, and ofcourse why this is a bad thing is that

It is NOT only a local exploit - it can be EXPLOITED REMOTELY if you use content-filters such as amavis, amavis-ng amavisd or amavisd-new as far as I'm aware of.

So all you using those filters - and perhaps others? would do nicely to upgrade your file tool

_________________
Best regards,

Klavs Klavsen
Denmark

Working with Unix is like wrestling a worthy opponent.
Working with windows is like attacking a small whining child
who is carrying a .38.

pjp · Administrator Joined: 16 Apr 2002 Posts: 20067

Doesn't look like there's a bug report yet, but the devs probably know about it.
_________________
Quis separabit? Quo animo?