PT-2019-6553 · Mailscanner · Mailscanner

Raphael Geissert · Published 2019-11-12 · Updated 2019-11-15 · CVE-2010-3292

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions mailscanner version 4.79.11-2

Description The issue concerns the update{ bad,} phishing sites scripts in mailscanner, which download files without using encryption or digital signature checking. This could allow an attacker to replace certain configuration files, such as the phishing whitelist, via DNS or packet spoofing.

Recommendations For mailscanner version 4.79.11-2, consider disabling the update{ bad,} phishing sites scripts until a secure update mechanism is implemented to prevent potential exploitation. Restrict access to configuration files to minimize the risk of unauthorized modifications.

Fix

Missing Encryption of Sensitive Data

Weakness Enumeration

CWE-311

Related Identifiers

CVE-2010-3292

Affected Products

Mailscanner

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2010-3292 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2010-3292 · Vendor Advisory
• https://access.redhat.com/security/cve/cve-2010-3292 · Note
• https://openwall.com/lists/oss-security/2010/09/13/9 · Note
• https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=596396 · Note