[Exim] Exim filters and potential security issues.

Top Page
Delete this message
Reply to this message
Author: Nico Erfurth
Date:  
To: Exim-users
Subject: [Exim] Exim filters and potential security issues.
Hi everyone,

while doing some other work tonight, two things about exim filters came
to my mind.

1.) The user can access $address_data, in most setups, this isn't a real
     problem, but it could be with some (rare) setups.
     If the admins saves sensible data inside of address_data. I know,
     mostly this will be only data relevant to the user, but who knows?
     Philip, while reworking the manual, can you please note this point?


2.) Exim filters have a nice feature, they allow to log with the
     logfile/logwrite commands, BUT in a virtual only setup, this can
     lead to problems. When all users are using the same UID and are
     allowed to use exim-filters (as on my machine), an attacker could be
     able to use logwrite to write mail into some other users maildir, or
     doing other REALLY worse things.


Nico