[Raw Msg Headers][Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: Header re-write

Marco Hernandez <marco@yukon.cren.org> writes:
> If you don't want to "divulge"
> holes to the list, then let the developer know your thought.... 

I did report these problems to Matti quite some time ago.  Last I
heard, he had fixed many instances of the problem in his sources but
wasn't able to find all such instances.  The nature of the bug is such
that the system administrator can easily and inadvertantly create new
instances of the hole in the process of installing and maintaining

A proper fix would require incompatibly replacing a core component of
Zmailer.  The scope of the bug is that an attacker can cause the
Zmailer subsystem to execute fairly arbitrary commands.

Janus reportedly runs Zmailer in a restricted environment, so its
vulnerability to Zmailer bugs would seem to be limited.