FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

CVE-2007-2873

This CVE name corresponds to:

Entered	Topic
2007-06-18	p5-Mail-SpamAssassin -- local user symlink-attack DoS vulnerability

The following information is adapted from the Common Vulnerabilities and Exposures (CVE) project. CVE and the CVE logo are trademarks of The MITRE Corporation. CVE content is Copyright 2005, The MITRE Corporation.

CVE-2007-2873 at cve.mitre.org

Details

Type	Candidate
Name	CVE-2007-2873
Phase	Assigned(20070529)

Description

SpamAssassin 3.1.x, 3.2.0, and 3.2.1 before 20070611, when running as root in unusual configurations using vpopmail or virtual users, allows local users to cause a denial of service (corrupt arbitrary files) via a symlink attack on a file that is used by spamd.

References

Source	Reference
CONFIRM	http://spamassassin.apache.org/advisories/cve-2007-2873.txt
CONFIRM	https://issues.rpath.com/browse/RPL-1450
MANDRIVA	MDKSA-2007:125
REDHAT	RHSA-2007:0492
BID	24481
OVAL	oval:org.mitre.oval:def:10354
VUPEN	ADV-2007-2172
OSVDB	37234
SECTRACK	1018242
XF	spamassassin-symlink-dos(34864)