PT-2019-6553 · Mailscanner · Mailscanner

Raphael Geissert · Publicado 2019-11-12 · Atualizado 2019-11-15 · CVE-2010-3292

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Baixa

Vetor base

AV:L/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions mailscanner version 4.79.11-2

Description The issue concerns the update{ bad,} phishing sites scripts in mailscanner, which download files without using encryption or digital signature checking. This could allow an attacker to replace certain configuration files, such as the phishing whitelist, via DNS or packet spoofing.

Recommendations For mailscanner version 4.79.11-2, consider disabling the update{ bad,} phishing sites scripts until a secure update mechanism is implemented to prevent potential exploitation. Restrict access to configuration files to minimize the risk of unauthorized modifications.

Correção

Missing Encryption of Sensitive Data

Enumeração de Fraquezas

CWE-311

Identificadores relacionados

CVE-2010-3292

Produtos afetados

Mailscanner

Referências · 5

• https://access.redhat.com/security/cve/cve-2010-3292 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2010-3292 · Nota de Segurança
• https://security-tracker.debian.org/tracker/CVE-2010-3292 · Aviso do Fabricante
• https://openwall.com/lists/oss-security/2010/09/13/9 · Nota
• https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=596396 · Nota