[Exim] Exim filters and potential security issues.

Etusivu
Poista viesti
Vastaa
Lähettäjä: Nico Erfurth
Päiväys:  
Vastaanottaja: Exim-users
Aihe: [Exim] Exim filters and potential security issues.
Hi everyone,

while doing some other work tonight, two things about exim filters came
to my mind.

1.) The user can access $address_data, in most setups, this isn't a real
     problem, but it could be with some (rare) setups.
     If the admins saves sensible data inside of address_data. I know,
     mostly this will be only data relevant to the user, but who knows?
     Philip, while reworking the manual, can you please note this point?


2.) Exim filters have a nice feature, they allow to log with the
     logfile/logwrite commands, BUT in a virtual only setup, this can
     lead to problems. When all users are using the same UID and are
     allowed to use exim-filters (as on my machine), an attacker could be
     able to use logwrite to write mail into some other users maildir, or
     doing other REALLY worse things.


Nico