ID de Prueba:	1.3.6.1.4.1.25623.1.0.55612
Categoría:	Mandrake Local Security Checks
Título:	Mandrake Security Advisory MDKSA-2005:168 (masqmail)
Resumen:	NOSUMMARY
Descripción:	Description: The remote host is missing an update to masqmail announced via advisory MDKSA-2005:168. Jens Steube discovered two vulnerabilities in masqmail: When sending failed mail messages, the address was not properly sanitized which could allow a local attacker to execute arbitrary commands as the mail user (CVE-2005-2662). When opening the log file, masqmail did not relinquish privileges, which could allow a local attacker to overwrite arbitrary files via a symlink attack (CVE-2005-2663). The updated packages have been patched to address these issues. Affected versions: Multi Network Firewall 2.0 Solution: To upgrade automatically use MandrakeUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you. https://secure1.securityspace.com/smysecure/catid.html?in=MDKSA-2005:168 Risk factor : High CVSS Score: 7.5
Referencia Cruzada:	Common Vulnerability Exposure (CVE) ID: CVE-2005-2662 BugTraq ID: 14890 http://www.securityfocus.com/bid/14890 Debian Security Information: DSA-848 (Google Search) http://www.debian.org/security/2005/dsa-848 http://www.mandriva.com/security/advisories?name=MDKSA-2005:168 http://www.osvdb.org/displayvuln.php?osvdb_id=19583 http://secunia.com/advisories/16883 http://secunia.com/advisories/17109 http://www.vupen.com/english/advisories/2005/1807 XForce ISS Database: masqmail-email-gain-privileges(22346) https://exchange.xforce.ibmcloud.com/vulnerabilities/22346 Common Vulnerability Exposure (CVE) ID: CVE-2005-2663 http://www.osvdb.org/displayvuln.php?osvdb_id=19584 XForce ISS Database: masqmail-log-file-symlink(22347) https://exchange.xforce.ibmcloud.com/vulnerabilities/22347
Copyright	Copyright (c) 2005 E-Soft Inc. http://www.securityspace.com

Esta es sólo una de 146377 pruebas de vulnerabilidad en nuestra serie de pruebas. Encuentre más sobre cómo ejecutar una auditoría de seguridad completa. Para ejecutar una prueba gratuita de esta vulnerabilidad contra su sistema, regístrese ahora.