Re: Header re-write

[John Gardiner Myers <jgm+@CMU.EDU>]

Marco Hernandez <marco@yukon.cren.org> writes:
> If you don't want to "divulge"
> holes to the list, then let the developer know your thought.... 

I did report these problems to Matti quite some time ago.  Last I
heard, he had fixed many instances of the problem in his sources but
wasn't able to find all such instances.  The nature of the bug is such
that the system administrator can easily and inadvertantly create new
instances of the hole in the process of installing and maintaining
Zmailer.

A proper fix would require incompatibly replacing a core component of
Zmailer.  The scope of the bug is that an attacker can cause the
Zmailer subsystem to execute fairly arbitrary commands.

Janus reportedly runs Zmailer in a restricted environment, so its
vulnerability to Zmailer bugs would seem to be limited.