|
|
|
View Notes By
|
|
|
|
Other Documents
|
|
|
|
|
SuSE Inc. Information for VU#336083
| Date Notified | 07/15/2002 |
| Date Modified | 12/13/2002 11:41:58 AM |
| Status Summary | Unknown |
Vendor StatementThe SuSE security team has been aware of this issue for several years. We would like to point out that not overwriting existing files is not sufficient protection, as an attacker may also gain access by creating files that were not there previously (e.g. many people don't have ~/.shosts or ~/.ssh/authorized_keys2).
The best solution in our opinion is to make sure that all mail user agents etc always invoke uudecode with a filename argument on the command line. This is the case for SuSE Linux, so we do not consider ourselves vulnerable to this issue.US-CERT AddendumThis statement from the SuSE Security Team provides no indication that this vulnerability has been addressed.
If you have feedback, comments, or additional information about this vulnerability, please send us
email.
|
 |
