Debian: New flamethrower packages fix denial of service


 
Thread Tools Search this Thread
Special Forums Cybersecurity Security Advisories (RSS) Debian: New flamethrower packages fix denial of service
# 1  
Old 12-02-2008
Debian: New flamethrower packages fix denial of service

LinuxSecurity.com: Dmitry E. Oboukhov discovered that flamethrower creates predictable temporary filenames, which may lead to a local denial of service through a symlink attack.

More...
Login or Register to Ask a Question

Previous Thread | Next Thread
Login or Register to Ask a Question
SHOWQ(8)						      System Manager's Manual							  SHOWQ(8)

NAME
showq - list the Postfix mail queue SYNOPSIS
showq [generic Postfix daemon options] DESCRIPTION
The showq daemon reports the Postfix mail queue status. It is the program that emulates the sendmail `mailq' command. The showq daemon can also be run in stand-alone mode by the super-user. This mode of operation is used to emulate the `mailq' command while the Postfix mail system is down. SECURITY
The showq daemon can run in a chroot jail at fixed low privilege, and takes no input from the client. Its service port is accessible to local untrusted users, so the service can be susceptible to denial of service attacks. STANDARDS
None. The showq daemon does not interact with the outside world. DIAGNOSTICS
Problems and transactions are logged to syslogd(8). BUGS
The showq daemon runs at a fixed low privilege; consequently, it cannot extract information from queue files in the maildrop directory. SEE ALSO
cleanup(8) canonicalize and enqueue mail pickup(8) local mail pickup service qmgr(8) mail being delivered, delayed mail syslogd(8) system logging LICENSE
The Secure Mailer license must be distributed with this software. AUTHOR(S) Wietse Venema IBM T.J. Watson Research P.O. Box 704 Yorktown Heights, NY 10598, USA SHOWQ(8)