Setuid programs that are part of the iPlanet Messaging Server version 5.2 HotFix 1.16 try to read the configuration file msg.conf. If the environment variable CONFIGROOT is set, the configuration is read from that directory. A symlink attack is possible, and as a result it is possible to read the first line of any file with uid 0 privileges.
94e5f407bee15f4c3e6a69c53eb00a2486a4512d76f18261bc67b01b6568470b
© 2024 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed