Ejabberd : Symlink vulnerability during installation process
Date : 2006-04-25
Vendor : www.process-one.net
Products : ejabberd binary installation for Linux
Vulnerable Versions : 1.1.1_1 and prior versions
When root user is running ejabberd-1.1.1_1-linux-installer.bin (in
order to install the Jabber server ejabberd). It creates in an insecure mode
a file named bitrock_installer.log in the /tmp directory.
Local users are abble to perform a symlink attack and then cause
a DoS on the local machine.
_________________________________________________________________
FREE pop-up blocking with the new MSN Toolbar - get it now!
http://toolbar.msn.click-url.com/go/onm00200415ave/direct/01/