Debian Bug report logs - #506353
CVE-2008-5312/3: mailscanner might allow local users to overwrite arbitrary files via a symlink attack

version graph

Package: mailscanner; Maintainer for mailscanner is Simon Walter <simon.walter@hp-factory.de>;

Reported by: Raphael Geissert <atomo64@gmail.com>

Date: Thu, 20 Nov 2008 21:33:28 UTC

Severity: grave

Tags: confirmed, fixed-upstream, help, security, upstream

Found in version mailscanner/4.55.10-3

Fixed in version mailscanner/4.74.16-1

Done: Simon Walter <simon.walter@hp-factory.de>

Bug is archived. No further changes may be made.

Forwarded to http://lists.mailscanner.info/pipermail/mailscanner/2008-December/088750.html

Toggle useless messages

View this report as an mbox folder, status mbox, maintainer mbox


Report forwarded to debian-bugs-dist@lists.debian.org, bugtraq@securityfocus.com, Simon Walter <simon.walter@hp-factory.de>:
Bug#506353; Package mailscanner. (Thu, 20 Nov 2008 21:33:31 GMT) Full text and rfc822 format available.

Message #3 received at submit@bugs.debian.org (full text, mbox):

From: Raphael Geissert <atomo64@gmail.com>
To: submit@bugs.debian.org
Subject: mailscanner: many scripts allow local users to overwrite arbitrary files, and more, via symlink attacks
Date: Thu, 20 Nov 2008 15:24:46 -0600
[Message part 1 (text/plain, inline)]
Package: mailscanner
Version: 4.55.10-3
Severity: grave
Tags: security

Hi,

I have found more issues on the autoupdate scripts and other files shipped by 
mailscanner than those reported in CVE-2008-5140[1].

In 4.55.10-3, grepping the files throw this:
/etc/MailScanner/autoupdate/:
> f-prot-autoupdate:$TempDir    = "/var/tmp/f-prot";
> f-prot-autoupdate:$TmpFile = "tmp-web";
> clamav-autoupdate:$LogFile = "/tmp/ClamAV.update.log";
> panda-autoupdate.new:TEMPDIR="/tmp"
> trend-autoupdate.new:wget -q -O /tmp/$OPRINI $FTPSERV/opr.ini
> trend-autoupdate.new:NEWVER=`grep PatternVersionNPF /tmp/opr.ini.$$ | sed 
s/^PatternVersionNPF=//g | cut -c 3-5`
> trend-autoupdate.new:        wget -q -P /tmp  $FTPSERV/lpt$NEWVER.zip 
> trend-autoupdate.new:        DATCHECK=`unzip -o -t /tmp/lpt$NEWVER.zip |
> grep "No errors"`
> trend-autoupdate.new:                mv /tmp/lpt$NEWVER.zip /etc/iscan
> trend-autoupdate.new:rm -f /tmp/lpt*.zip /tmp/$OPRINI $PackageDir/*.zip 
> rav-autoupdate.new:my($LockFile)  = '/tmp/RavBusy.lock';

(omitting other affected files in that package version, read below)

In 4.68.8-1:
/etc/MailScanner/autoupdate/:
> f-prot-autoupdate:$TempDir    = "$FProtRoot/tmp";
> f-prot-autoupdate:$TmpFile = "tmp-web";
> clamav-autoupdate:$LogFile = "/tmp/ClamAV.update.log";
> avast-autoupdate:$LogFile = "/tmp/Avast.update.log";
> f-prot-6-autoupdate:my $logfile = "/tmp/f-prot-6-update-$$";
> f-prot-6-autoupdate:  unlink "/tmp/fpavdef.lock";

/etc/MailScanner/wrapper/:
> bitdefender-wrapper:LogFile=/tmp/log.bdc.$$
> kaspersky-wrapper:  Report=/tmp/kavoutput.tmp.$$
> kaspersky-wrapper:  Report=/tmp/kavoutput.tmp.$$
> kaspersky-wrapper:  Report=/tmp/kavoutput.tmp.$$
> clamav-wrapper:TempDir="/tmp/clamav.$$"
> clamav-wrapper:if [ -x "${TempDir}" ]; then
> clamav-wrapper: rm -rf ${TempDir} >/dev/null 2>&1
> clamav-wrapper:mkdir "${TempDir}" >/dev/null 2>&1
> clamav-wrapper:trap "rm -rf ${TempDir}" EXIT
> clamav-wrapper:  ExtraScanOptions="$ExtraScanOptions --tempdir=${TempDir}"
> clamav-wrapper:    chown ${ClamUser}:${ClamGroup} "${TempDir}"
> clamav-wrapper:if [ -x "${TempDir}" ]; then
> clamav-wrapper: rm -rf ${TempDir}
> rav-wrapper:my $tmpdir = '/tmp';
> rav-wrapper:my $reportfile = sprintf('%s/report.vir.%s', $tmpdir, $$);

/usr/share/MailScanner/MailScanner/:
> Quarantine.pm:  $testfn = MailScanner::Config::Value('lockfiledir')
> || '/tmp'; 
> TNEF.pm:   require File::Temp; 
> TNEF.pm:  mkdir "/tmp/tnef.$$", 0777;
> TNEF.pm:  chmod 0700, "/tmp/tnef.$$";
> TNEF.pm:             output_dir      => "/tmp/tnef.$$",
> TNEF.pm:    system("rm -rf /tmp/tnef.$$");
> TNEF.pm:    system("rm -rf /tmp/tnef.$$");
> MessageBatch.pm:  my $newmessage = MailScanner::Message->new(1, '/tmp', 1);
> MessageBatch.pm:  my $fh = new FileHandle(">/tmp/MSLint.body.$$");
> MessageBatch.pm:  $newmessage->{store}->{dpath} = "/tmp/MSLint.body.$$";
> WorkArea.pm:  $testfn = MailScanner::Config::Value('lockfiledir') ||
> '/tmp';
> WorkArea.pm:      or MailScanner::Log::DieLog("Cannot create temporary Work
> Dir %s. " .
> SA.pm:  # Create the $TMPDIR for SpamAssassin if necessary, then check we
> can 
> SA.pm:  # write to it. If not, change to /tmp. 
> SA.pm:  my $tmpdir = MailScanner::Config::Value('spamassassintempdir');
> SA.pm:  mkdir $tmpdir;
> SA.pm:  stat $tmpdir; # Is the directory writeable?
> SA.pm:  $tmpdir = '/tmp' unless -d _ && -r _ && -w _ && -x _;
> SA.pm:  $ENV{'TMPDIR'} = $tmpdir;
> SA.pm:  MailScanner::Log::InfoLog("SpamAssassin temporary working directory
> is %s", 
> SA.pm:                            $tmpdir); 
> SA.pm:  print STDERR "SpamAssassin temp dir = $tmpdir\n";

Other dirs:
> /etc/MailScanner/mailscanner.conf.with.mcp:Lockfile Dir = /tmp
> /usr/sbin/MailScanner:  unlink "/tmp/MSLint.body.$$";
> /usr/sbin/MailScanner:  $msg = MailScanner::Message->new('1','/tmp','fake');

I'm using severity grave as this package should definitely not be shipped in 
any release as is.

A good start point to fix this mess is by checking the above mentioned files, 
and then grep -riE "\bte?mp[^l]" path/to/code, and carefully review the 
matches files.

Of course, not even that would guarantee that there are no left ways to 
conduct symlink attacks via temporary files.
A full code audition is really needed IMHO.

[1] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5140
     http://security-tracker.debian.net/tracker/CVE-2008-5140

Cheers,
-- 
Raphael Geissert - Debian Maintainer
www.debian.org - get.debian.net
[signature.asc (application/pgp-signature, inline)]

Information forwarded to debian-bugs-dist@lists.debian.org, Simon Walter <simon.walter@hp-factory.de>:
Bug#506353; Package mailscanner. (Wed, 03 Dec 2008 12:42:06 GMT) Full text and rfc822 format available.

Acknowledgement sent to Mark Purcell <msp@debian.org>:
Extra info received and forwarded to list. Copy sent to Simon Walter <simon.walter@hp-factory.de>. (Wed, 03 Dec 2008 12:42:06 GMT) Full text and rfc822 format available.

Message #8 received at 506353@bugs.debian.org (full text, mbox):

From: Mark Purcell <msp@debian.org>
To: 506353@bugs.debian.org, Simon Walter <simon.walter@hp-factory.de>
Cc: Raphael Geissert <atomo64@gmail.com>
Subject: Re: Bug#506353: mailscanner: many scripts allow local users to overwrite arbitrary files, and more, via symlink attacks
Date: Wed, 3 Dec 2008 23:38:02 +1100
On Friday 21 November 2008 08:24:46 Raphael Geissert wrote:
> I'm using severity grave as this package should definitely not be shipped
> in any release as is.

Simon,

This RC bug was reported almost two weeks ago without any comment from you.

Are you in a position to investigate and propose a way forward for your 
package in lenny?

Thanks,
Mark




Information forwarded to debian-bugs-dist@lists.debian.org:
Bug#506353; Package mailscanner. (Wed, 03 Dec 2008 21:33:05 GMT) Full text and rfc822 format available.

Acknowledgement sent to Simon Walter <simon.walter@hp-factory.de>:
Extra info received and forwarded to list. (Wed, 03 Dec 2008 21:33:05 GMT) Full text and rfc822 format available.

Message #13 received at 506353@bugs.debian.org (full text, mbox):

From: Simon Walter <simon.walter@hp-factory.de>
To: Mark Purcell <msp@debian.org>
Cc: 506353@bugs.debian.org, Raphael Geissert <atomo64@gmail.com>, mailscanner@ecs.soton.ac.uk
Subject: Re: Bug#506353: mailscanner: many scripts allow local users to overwrite arbitrary files, and more, via symlink attacks
Date: Wed, 03 Dec 2008 22:28:09 +0100
package mailscanner
tags 506353 help upstream confirmed
thanks

Hello,

Mark Purcell <msp@debian.org> writes:
> On Friday 21 November 2008 08:24:46 Raphael Geissert wrote:
>> I'm using severity grave as this package should definitely not be shipped
>> in any release as is.
>
> Simon,
>
> This RC bug was reported almost two weeks ago without any comment from you.
>
> Are you in a position to investigate and propose a way forward for your 
> package in lenny?

I have looked at the code-segments Raphael pointed out and I'm totally
agree with him. In the current state the package should not be part of
the lenny release.

I'm in no position to fix all this. I'm not familiar enough with the
MailScanner sourcecode and I'm not able to test the changes I would
have to make, in particular to all the virusscanner scripts.


I have put Julian Field (upstream author) in CC to inform him about
all this. (@Julian: the full bugreport is here [1])

If he is willing and able to fix the problems in a feature
release before lenny is released I will try to backport the fixes to
the current package in lenny.


Otherwise this package should be removed.


I'm also wondering why [2] marks CVE-2008-5140 as fixed for
sid+lenny. It claims the bug was fix with 4.57.6-1, but there is no
difference between 4.55.10-3 and 4.57.6-1.

Sorry for the late reply.

-- 
Regards
Simon Walter

[1] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=506353
[2] http://security-tracker.debian.net/tracker/CVE-2008-5140




Tags added: help, upstream, confirmed Request was from Simon Walter <simon.walter@hp-factory.de> to control@bugs.debian.org. (Wed, 03 Dec 2008 21:33:07 GMT) Full text and rfc822 format available.

Information forwarded to debian-bugs-dist@lists.debian.org, Simon Walter <simon.walter@hp-factory.de>:
Bug#506353; Package mailscanner. (Thu, 04 Dec 2008 01:12:02 GMT) Full text and rfc822 format available.

Message #18 received at 506353@bugs.debian.org (full text, mbox):

From: Raphael Geissert <atomo64@gmail.com>
To: 506353@bugs.debian.org
Cc: Mark Purcell <msp@debian.org>, mailscanner@ecs.soton.ac.uk, team@security.debian.org
Subject: Re: Bug#506353: mailscanner: many scripts allow local users to overwrite arbitrary files, and more, via symlink attacks
Date: Wed, 3 Dec 2008 19:09:57 -0600
[Message part 1 (text/plain, inline)]
retitle 506353 CVE-2008-5312/3: mailscanner might allow local users to overwrite arbitrary files via a symlink attack
thanks

On Wednesday 03 December 2008, Simon Walter wrote:
>
> Hello,

Hello,

[...]
>
> I have put Julian Field (upstream author) in CC to inform him about
> all this. (@Julian: the full bugreport is here [1])
>
> If he is willing and able to fix the problems in a feature
> release before lenny is released I will try to backport the fixes to
> the current package in lenny.
>
>
> Otherwise this package should be removed.
>

Ok, let's see what happens.

>
> I'm also wondering why [2] marks CVE-2008-5140 as fixed for
> sid+lenny. It claims the bug was fix with 4.57.6-1, but there is no
> difference between 4.55.10-3 and 4.57.6-1.

Because the trend-autoupdate.new script was no longer shipped in 4.57.6-1,
thereby "fixing" the problem, as to what Debian matters.

For the other issues I reported on my original email which are not covered in
CVE-2008-5140, the following two CVE ids have been assigned:
CVE-2008-5312[C1] and CVE-2008-5313[C2].
Those are the ones that need to be fixed for this bug to get closed.

Oh, and just to make sure everybody got the message: version in etch is
vulnerable as well. I'm CC'ing the stable security team so that they comment on
what to do with it.

[C1]http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5312
       http://security-tracker.debian.net/tracker/CVE-2008-5312
[C2]http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5313
       http://security-tracker.debian.net/tracker/CVE-2008-5313

>
> Sorry for the late reply.

Cheers,
-- 
Raphael Geissert - Debian Maintainer
www.debian.org - get.debian.net
[signature.asc (application/pgp-signature, inline)]

Changed Bug title to `CVE-2008-5312/3: mailscanner might allow local users to overwrite arbitrary files via a symlink attack' from `mailscanner: many scripts allow local users to overwrite arbitrary files, and more, via symlink attacks'. Request was from Raphael Geissert <atomo64@gmail.com> to control@bugs.debian.org. (Thu, 04 Dec 2008 01:12:03 GMT) Full text and rfc822 format available.

Noted your statement that Bug has been forwarded to http://lists.mailscanner.info/pipermail/mailscanner/2008-December/088750.html. Request was from Don Armstrong <don@debian.org> to control@bugs.debian.org. (Sun, 14 Dec 2008 11:42:03 GMT) Full text and rfc822 format available.

Tags added: fixed-upstream Request was from Don Armstrong <don@debian.org> to control@bugs.debian.org. (Sun, 14 Dec 2008 11:42:04 GMT) Full text and rfc822 format available.

Information forwarded to debian-bugs-dist@lists.debian.org, Simon Walter <simon.walter@hp-factory.de>:
Bug#506353; Package mailscanner. (Tue, 23 Dec 2008 22:27:05 GMT) Full text and rfc822 format available.

Acknowledgement sent to Thomas Viehmann <tv@beamnet.de>:
Extra info received and forwarded to list. Copy sent to Simon Walter <simon.walter@hp-factory.de>. (Tue, 23 Dec 2008 22:27:05 GMT) Full text and rfc822 format available.

Message #29 received at 506353@bugs.debian.org (full text, mbox):

From: Thomas Viehmann <tv@beamnet.de>
To: debian-release@lists.debian.org
Cc: 506652@bugs.debian.org, 506353@bugs.debian.org, 507021@bugs.debian.org
Subject: lenny removal requests
Date: Tue, 23 Dec 2008 23:26:13 +0100
Hi,

so here are three RC bugs with maintainers clearly indicating that they
don't want the buggy packages to release and none look like they will be
fixed. The package do not have reverse dependencies, so they seem to be
good for removal.

xml2rfc #506652
  The maintainer Florian Weimer:
  This means we shouldn't release the current xml2rfc version with
  lenny.

mailscanner #506353
  The maintainer Simon Walter writes:
    In the current state the package should not be part of
    the lenny release.
    I'm in no position to fix all this. I'm not familiar enough with
    the MailScanner sourcecode and I'm not able to test the changes I
    would have to make, in particular to all the virusscanner scripts.
  upstream apparently does not seem to, let's say, consider the tempfile
  vulnerability a bug and does not seem to want to fix it.

helpdeco #507021
  The maintainer Paul Wise writes:
  Based on the issues I found and fixed in upstream SVN last year with
  the zzuf input fuzzer, I don't think the current version should be
  allowed into lenny on any architecture

Kind regards

T.
-- 
Thomas Viehmann, http://thomas.viehmann.net/




Information forwarded to debian-bugs-dist@lists.debian.org, Simon Walter <simon.walter@hp-factory.de>:
Bug#506353; Package mailscanner. (Wed, 24 Dec 2008 10:24:02 GMT) Full text and rfc822 format available.

Acknowledgement sent to "Gabor FUNK" <FUNK.Gabor@hunetkft.hu>:
Extra info received and forwarded to list. Copy sent to Simon Walter <simon.walter@hp-factory.de>. (Wed, 24 Dec 2008 10:24:02 GMT) Full text and rfc822 format available.

Message #34 received at 506353@bugs.debian.org (full text, mbox):

From: "Gabor FUNK" <FUNK.Gabor@hunetkft.hu>
To: "Thomas Viehmann" <tv@beamnet.de>, <506353@bugs.debian.org>, <debian-release@lists.debian.org>, "Simon Walter" <simon.walter@hp-factory.de>, "Mark Purcell" <msp@debian.org>
Cc: <506353@bugs.debian.org>, "Raphael Geissert" <atomo64@gmail.com>, <mailscanner@ecs.soton.ac.uk>
Subject: Re: Bug#506353: lenny removal requests
Date: Wed, 24 Dec 2008 11:20:42 +0100
> so here are three RC bugs with maintainers clearly indicating that they
> don't want the buggy packages to release and none look like they will be
> fixed. The package do not have reverse dependencies, so they seem to be
> good for removal.
> ....
> mailscanner #506353
>  The maintainer Simon Walter writes:
>    In the current state the package should not be part of
>    the lenny release.
>    I'm in no position to fix all this. I'm not familiar enough with
>    the MailScanner sourcecode and I'm not able to test the changes I
>    would have to make, in particular to all the virusscanner scripts.
>  upstream apparently does not seem to, let's say, consider the tempfile
>  vulnerability a bug and does not seem to want to fix it.

The mailscanner temp vulnerability seems to be fixed in upstream:

---
http://www.mailscanner.info/ChangeLog
18/12/2008 New in Version 4.74.11-1
...
* Fixes *
2 Major work on removing symlink attack vulnerabilities 
affecting -autoupdate
 lock files.
 Note: This vulnerability only affected systems where normal interactive 
users
 could log in to the system, or create arbitrary symlinks in your 
filesystem.
 So the ISP-style setups were never vulnerable, as they didn't allow normal
 users to login or allow people to arbitrarily create symlinks in the 
filesystem.
2 Removed symlink attack vulnerabilities in SpamAssassin
---

Or are there more?

G. 





Information forwarded to debian-bugs-dist@lists.debian.org, Simon Walter <simon.walter@hp-factory.de>:
Bug#506353; Package mailscanner. (Wed, 24 Dec 2008 16:15:02 GMT) Full text and rfc822 format available.

Acknowledgement sent to Marc 'HE' Brockschmidt <he@ftwca.de>:
Extra info received and forwarded to list. Copy sent to Simon Walter <simon.walter@hp-factory.de>. (Wed, 24 Dec 2008 16:15:02 GMT) Full text and rfc822 format available.

Message #39 received at 506353@bugs.debian.org (full text, mbox):

From: Marc 'HE' Brockschmidt <he@ftwca.de>
To: Thomas Viehmann <tv@beamnet.de>
Cc: debian-release@lists.debian.org, 506652@bugs.debian.org, 506353@bugs.debian.org, 507021@bugs.debian.org
Subject: Re: lenny removal requests
Date: Wed, 24 Dec 2008 17:11:55 +0100
[Message part 1 (text/plain, inline)]
Thomas Viehmann <tv@beamnet.de> writes:
> xml2rfc #506652
>   The maintainer Florian Weimer:
>   This means we shouldn't release the current xml2rfc version with
>   lenny.

Removal hint added. Should a solution to this problem become available
soonish, the package should get back into lenny.

> mailscanner #506353
>   The maintainer Simon Walter writes:
>     In the current state the package should not be part of
>     the lenny release.
>     I'm in no position to fix all this. I'm not familiar enough with
>     the MailScanner sourcecode and I'm not able to test the changes I
>     would have to make, in particular to all the virusscanner scripts.
>   upstream apparently does not seem to, let's say, consider the tempfile
>   vulnerability a bug and does not seem to want to fix it.

Removal hint added. FWIW, software like mailscanner, having extensive
contact with possible attackers, should be maintained by someone who's
able to fix security issues in a timely manner. The fact that it isn't
is grounds to remove it from lenny.

> helpdeco #507021
>   The maintainer Paul Wise writes:
>   Based on the issues I found and fixed in upstream SVN last year with
>   the zzuf input fuzzer, I don't think the current version should be
>   allowed into lenny on any architecture

Remova hint added.

Thanks for your work, Thomas.

Happy holidays,
Marc
-- 
Fachbegriffe der Informatik - Einfach erklärt
84: Psychologe
       neurolinguistischer Programmierer (Oliver Bandel)
[Message part 2 (application/pgp-signature, inline)]

Information forwarded to debian-bugs-dist@lists.debian.org, Simon Walter <simon.walter@hp-factory.de>:
Bug#506353; Package mailscanner. (Wed, 24 Dec 2008 16:27:02 GMT) Full text and rfc822 format available.

Acknowledgement sent to "Gabor FUNK" <FUNK.Gabor@hunetkft.hu>:
Extra info received and forwarded to list. Copy sent to Simon Walter <simon.walter@hp-factory.de>. (Wed, 24 Dec 2008 16:27:02 GMT) Full text and rfc822 format available.

Message #44 received at 506353@bugs.debian.org (full text, mbox):

From: "Gabor FUNK" <FUNK.Gabor@hunetkft.hu>
To: "Thomas Viehmann" <tv@beamnet.de>, <506353@bugs.debian.org>, <debian-release@lists.debian.org>, "Simon Walter" <simon.walter@hp-factory.de>, "Mark Purcell" <msp@debian.org>
Cc: <506353@bugs.debian.org>, "Raphael Geissert" <atomo64@gmail.com>, <mailscanner@ecs.soton.ac.uk>, "Marc 'HE' Brockschmidt" <he@ftwca.de>
Subject: Re: Bug#506353: lenny removal requests
Date: Wed, 24 Dec 2008 17:24:59 +0100
I'm forwarding this I got from Julian (mailscanner upstream).

G.

----- Original Message ----- 
From: "Julian Field" <MailScanner@ecs.soton.ac.uk>
To: "Gabor FUNK" <FUNK.Gabor@hunetkft.hu>
Sent: Wednesday, December 24, 2008 3:27 PM
Subject: Re: Bug#506353: lenny removal requests

The vulnerabilities in MailScanner have all been fixed.

On 24/12/08 10:20, Gabor FUNK wrote:
>> so here are three RC bugs with maintainers clearly indicating that they
>> don't want the buggy packages to release and none look like they will be
>> fixed. The package do not have reverse dependencies, so they seem to be
>> good for removal.
>> ....
>> mailscanner #506353
>>  The maintainer Simon Walter writes:
>>    In the current state the package should not be part of
>>    the lenny release.
>>    I'm in no position to fix all this. I'm not familiar enough with
>>    the MailScanner sourcecode and I'm not able to test the changes I
>>    would have to make, in particular to all the virusscanner scripts.
>>  upstream apparently does not seem to, let's say, consider the tempfile
>>  vulnerability a bug and does not seem to want to fix it.
>
> The mailscanner temp vulnerability seems to be fixed in upstream:
>
> ---
> http://www.mailscanner.info/ChangeLog
> 18/12/2008 New in Version 4.74.11-1
> ...
> * Fixes *
> 2 Major work on removing symlink attack vulnerabilities affecting 
> -autoupdate
>  lock files.
>  Note: This vulnerability only affected systems where normal 
> interactive users
>  could log in to the system, or create arbitrary symlinks in your 
> filesystem.
>  So the ISP-style setups were never vulnerable, as they didn't allow 
> normal
>  users to login or allow people to arbitrarily create symlinks in the 
> filesystem.
> 2 Removed symlink attack vulnerabilities in SpamAssassin
> ---
>
> Or are there more?
>
> G.

Jules

-- 
Julian Field MEng CITP CEng
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

MailScanner customisation, or any advanced system administration help?
Contact me at Jules@Jules.FM

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
PGP public key: http://www.jules.fm/julesfm.asc


-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.





Information forwarded to debian-bugs-dist@lists.debian.org:
Bug#506353; Package mailscanner. (Wed, 24 Dec 2008 22:51:03 GMT) Full text and rfc822 format available.

Acknowledgement sent to Simon Walter <simon.walter@hp-factory.de>:
Extra info received and forwarded to list. (Wed, 24 Dec 2008 22:51:03 GMT) Full text and rfc822 format available.

Message #49 received at 506353@bugs.debian.org (full text, mbox):

From: Simon Walter <simon.walter@hp-factory.de>
To: "Gabor FUNK" <FUNK.Gabor@hunetkft.hu>
Cc: "Thomas Viehmann" <tv@beamnet.de>, <506353@bugs.debian.org>, <debian-release@lists.debian.org>, "Mark Purcell" <msp@debian.org>, "Raphael Geissert" <atomo64@gmail.com>, <mailscanner@ecs.soton.ac.uk>, Noah Meyerhans <frodo@morgul.net>, team@security.debian.org
Subject: Re: Bug#506353: lenny removal requests
Date: Wed, 24 Dec 2008 23:47:26 +0100
[Message part 1 (text/plain, inline)]
Hi

"Gabor FUNK" <FUNK.Gabor@hunetkft.hu> writes:
>> mailscanner #506353
>>  The maintainer Simon Walter writes:
>>    In the current state the package should not be part of
>>    the lenny release.
>>    I'm in no position to fix all this. I'm not familiar enough with
>>    the MailScanner sourcecode and I'm not able to test the changes I
>>    would have to make, in particular to all the virusscanner scripts.
>>  upstream apparently does not seem to, let's say, consider the tempfile
>>  vulnerability a bug and does not seem to want to fix it.
>
> The mailscanner temp vulnerability seems to be fixed in upstream:

Yes, upstream has fixed the vulnerability, but not yet release a
stable (non-beta) version. Next stable release will be on 01.01.09 but
this release will also come with quite some features.

Noah Meyerhans from seacurity-team and I have been working on a
backport of the upstream fixes for mailscanner-4.68.8.

Current state of this work is: It works (MailScanner starts and scans
a simple textmail) but it's not well tested.  There still need to be
done some testing with TNEF attachment, virus removal and some other
cases.

I currently don't Know when I will have the time to do this.

I have attached the diff against 4.68.8 debian package.

-- 
Regards
Simon Walter

[mailscanner_4.68.8-1+lenny1-proposed1.diff (text/x-diff, inline)]
diff -Naur mailscanner-4.68.8/debian/changelog mailscanner-4.68.8-1+lenny1-proposed/debian/changelog
--- mailscanner-4.68.8/debian/changelog	2008-12-24 23:29:01.000000000 +0100
+++ mailscanner-4.68.8-1+lenny1-proposed/debian/changelog	2008-12-24 23:27:44.000000000 +0100
@@ -1,3 +1,11 @@
+mailscanner (4.68.8-1+lenny1) testing-proposed-updates; urgency=high
+
+  * Security upload to fix CVE-2008-5140, CVE-2008-5312, CVE-2008-5312
+    (insecure creation of files in /tmp)
+    Thanks Raphael Geisser, Noah Meyerhans
+	
+ -- Simon Walter <simon.walter@hp-factory.de>  Mon, 22 Dec 2008 19:43:05 +0100
+
 mailscanner (4.68.8-1) unstable; urgency=low
 
   * New upstream release
diff -Naur mailscanner-4.68.8/debian/mailscanner.install mailscanner-4.68.8-1+lenny1-proposed/debian/mailscanner.install
--- mailscanner-4.68.8/debian/mailscanner.install	2008-12-24 23:29:01.000000000 +0100
+++ mailscanner-4.68.8-1+lenny1-proposed/debian/mailscanner.install	2008-12-24 23:27:44.000000000 +0100
@@ -2,6 +2,7 @@
 bin/df2mbox usr/sbin/
 bin/upgrade_MailScanner_conf usr/sbin/
 bin/MailScanner /usr/sbin
+bin/mailscanner_create_locks /usr/sbin
 bin/update_virus_scanners /usr/sbin
 bin/update_phishing_sites /usr/sbin
 lib/MailScanner.pm usr/share/MailScanner/
diff -Naur mailscanner-4.68.8/debian/patches/00list mailscanner-4.68.8-1+lenny1-proposed/debian/patches/00list
--- mailscanner-4.68.8/debian/patches/00list	2008-12-24 23:29:01.000000000 +0100
+++ mailscanner-4.68.8-1+lenny1-proposed/debian/patches/00list	2008-12-24 23:27:43.000000000 +0100
@@ -10,3 +10,4 @@
 update_virus_scanners.dpatch
 upgrade-manpage.dpatch
 use_spamassassinprefsconf.dpatch
+CVE-2008-5313.dpatch
diff -Naur mailscanner-4.68.8/debian/patches/CVE-2008-5313.dpatch mailscanner-4.68.8-1+lenny1-proposed/debian/patches/CVE-2008-5313.dpatch
--- mailscanner-4.68.8/debian/patches/CVE-2008-5313.dpatch	1970-01-01 01:00:00.000000000 +0100
+++ mailscanner-4.68.8-1+lenny1-proposed/debian/patches/CVE-2008-5313.dpatch	2008-12-24 23:27:43.000000000 +0100
@@ -0,0 +1,1335 @@
+#! /bin/sh /usr/share/dpatch/dpatch-run
+## CVE-2008-5313.dpatch by  <noahm@debian.org>
+##
+## All lines beginning with `## DP:' are a description of the patch.
+## DP: No description.
+
+@DPATCH@
+diff -urNad mailscanner-4.68.8~/bin/MailScanner mailscanner-4.68.8/bin/MailScanner
+--- mailscanner-4.68.8~/bin/MailScanner	2008-12-22 22:48:13.000000000 +0100
++++ mailscanner-4.68.8/bin/MailScanner	2008-12-22 22:48:14.000000000 +0100
+@@ -61,6 +61,7 @@
+ use FileHandle;
+ use File::Path;
+ use IO::Handle;
++use IO::File;
+ use Getopt::Long;
+ use Time::HiRes qw ( time );
+ use Filesys::Df;
+@@ -362,6 +363,18 @@
+                   " checking configuration...\n";
+   MailScanner::Log::Configure($logbanner, 'stderr');
+ 
++  # Check -autoupdate lock files
++  my $lockdir = MailScanner::Config::QuickPeek($ConfFile, 'lockfiledir');
++  if ($lockdir eq "" || $lockdir =~ /tmp$/i) {
++    print STDERR "Please move your \"Lockfile Dir\" setting in MailScanner.conf.\n";
++    print STDERR "It should point outside /tmp, preferably /var/spool/MailScanner/incoming/Locks\n";
++  }
++  my $cluid = MailScanner::Config::QuickPeek($ConfFile, 'runasuser');
++  my $clgid = MailScanner::Config::QuickPeek($ConfFile, 'runasgroup');
++  my $clr = system("/usr/sbin/mailscanner_create_locks \"$lockdir\" \"$cluid\" \"$clgid\"");
++  print STDERR "Error: Attempt to create locks in $lockdir failed!\n"
++    if ($clr>>8) != 0;
++
+   # Read the directory containing all the custom code
+   MailScanner::Config::initialise(MailScanner::Config::QuickPeek($ConfFile,
+                                   'customfunctionsdir'));
+@@ -446,6 +459,12 @@
+    }
+   }
+ 
++  # Check permissions on /tmp
++  if ($WantLintOnly) {
++    my $handle = IO::File->new_tmpfile or print STDERR "\nYour /tmp needs to be set to \"chmod 1777 /tmp\"\n";
++    close($handle);
++  }
++
+   # If it's a "light" check, then just bail out here, I've checked enough.
+   exit if $WantLintLiteOnly;
+ 
+@@ -631,6 +650,20 @@
+ WritePIDFile("MailScanner");
+ chown $uid, $gid, $PidFile;
+ 
++# Create the SpamAssassin temporary working dir
++MailScanner::SA::CreateTempDir($uid,
++      MailScanner::Config::QuickPeek($ConfFile, 'spamassassintemporarydir'));
++
++# Check and create -autoupdate lock files
++my $locksdir = MailScanner::Config::QuickPeek($ConfFile, 'lockfiledir');
++if ($locksdir eq "" || $locksdir =~ /tmp$/i) {
++  print STDERR "Please move your \"Lockfile Dir\" setting in MailScanner.conf.\n";
++  print STDERR "It should point outside /tmp, preferably /var/spool/MailScanner/incoming/Locks\n";
++}
++my $cl = system("/usr/sbin/mailscanner_create_locks \"$locksdir\" \"$uname\" \"$gname\"");
++print STDERR "Error: Attempt to create locks in $locksdir failed!\n"
++ if ($cl>>8) != 0;
++
+ SetUidGid($uid, $gid, $qgid, $igid);
+ CheckModuleVersions();
+ # Can't do this here, config not read yet: CheckQueuesAreTogether();
+diff -urNad mailscanner-4.68.8~/bin/mailscanner_create_locks mailscanner-4.68.8/bin/mailscanner_create_locks
+--- mailscanner-4.68.8~/bin/mailscanner_create_locks	1970-01-01 01:00:00.000000000 +0100
++++ mailscanner-4.68.8/bin/mailscanner_create_locks	2008-12-22 22:48:15.000000000 +0100
+@@ -0,0 +1,62 @@
++#!/usr/bin/perl
++
++use DirHandle;
++use FileHandle;
++use strict;
++no strict 'subs';
++
++# Find the root of the locks directory
++my $locksdirname = shift;
++my $lduname      = shift;
++my $ldgname      = shift;
++
++# Turn them all into numbers and stuff with sensible defaults
++$locksdirname = '/var/lock/subsys/MailScanner'
++  unless $locksdirname =~ /^\//;
++my $lduid = getpwnam($lduname);
++my $ldgid = getgrnam($ldgname);
++
++# If it's not a directory, destroy it and start again.
++lstat $locksdirname;
++unlink $locksdirname unless -d _;
++lstat $locksdirname;
++unless (-d _) {
++  mkdir $locksdirname or die "Can't mkdir $locksdirname, $!";
++}
++
++# Now work through all the virus scanner autoupdate names, building Lock files.
++my($dh, $fh, $updatename, $lockname, @updatenames, @locknames);
++$dh = new DirHandle "/etc/MailScanner/autoupdate";
++die "Can't read dir etc/MailScanner/autoupdate to build list of -autoupdate scripts, $!" unless $dh;
++while (defined($updatename = $dh->read)) {
++  next unless $updatename =~ s/-autoupdate$//;
++  next unless $updatename =~ /^[a-z0-9_-]+$/i; # No nasty chars thanks!
++  $lockname = "$locksdirname/$updatename" . "Busy.lock";
++  lstat $lockname;
++  unless (-f _) {
++    # It's not a plain file!
++    if (-d _) {
++      # It's a directory, so cannot just unlink it
++      system("rm -rf $lockname");
++    } else {
++      # It's not a plain file nor a directory, so just remove it
++      unlink $lockname;
++    }
++  }
++  $fh = new FileHandle($lockname, O_CREAT|O_WRONLY|O_APPEND);
++  $fh->close;
++  # Quicker to collect them and do 1 big chmod and chown call later.
++  push @locknames, $lockname;
++}
++$dh->close;
++
++# Set perms and ownership of /v/s/M/i/Locks to
++# drwxr-x--- root run-as-group
++chmod 0750, $locksdirname unless $locksdirname =~ /^\/tmp/;
++chown -1, $ldgid, $locksdirname;
++# Set perms and ownership of /v/s/M/i/Locks/*.lock to
++# -rw------- run-as-user run-as-group
++chmod 0600, @locknames;
++chown $lduid, $ldgid, @locknames;
++
++exit 0;
+diff -urNad mailscanner-4.68.8~/lib/MailScanner/MessageBatch.pm mailscanner-4.68.8/lib/MailScanner/MessageBatch.pm
+--- mailscanner-4.68.8~/lib/MailScanner/MessageBatch.pm	2008-12-22 20:51:38.000000000 +0100
++++ mailscanner-4.68.8/lib/MailScanner/MessageBatch.pm	2008-12-22 22:48:15.000000000 +0100
+@@ -42,6 +42,7 @@
+ use DirHandle;
+ use Time::HiRes qw ( time );
+ use POSIX;
++use File::Temp qw ( tempfile tempdir );
+ 
+ use vars qw($VERSION);
+ 
+@@ -1158,7 +1159,8 @@
+   # Message number = 1
+   # Path = irrelevant as we're not actually reading anything
+   # It's a fake that we simulate ==> 1
+-  my $newmessage = MailScanner::Message->new(1, '/tmp', 1);
++  my $MessageDir = tempdir( 'MSlintXXXXXX', CLEANUP => 1);
++  my $newmessage = MailScanner::Message->new(1, $MessageDir, 0, 1);
+   @{$newmessage->{headers}} = ();
+   @{$newmessage->{to}} = ();
+   @{$newmessage->{touser}} = ();
+@@ -1189,13 +1191,15 @@
+   $newmessage->WriteHeaderFile();
+ 
+   # Create a file of the body
+-  my $fh = new FileHandle(">/tmp/MSLint.body.$$");
++  my($fh, $temporaryname);
++  ($fh, $temporaryname) = tempfile()
++    or die "Could not create temp file $temporaryname for test message, $!";
+   print $fh <<EOFLint;
+ WDVPIVAlQEFQWzRcUFpYNTQoUF4pN0NDKTd9JEVJQ0FSLVNUQU5EQVJELUFOVElWSVJVUy1URVNU
+ LUZJTEUhJEgrSCo=
+ EOFLint
+   $fh->close();
+-  $newmessage->{store}->{dpath} = "/tmp/MSLint.body.$$";
++  $newmessage->{store}->{dpath} = $temporaryname;
+ 
+   # Add it to the batch
+   $batch->{messages}{"1"} = $newmessage;
+diff -urNad mailscanner-4.68.8~/lib/MailScanner/Quarantine.pm mailscanner-4.68.8/lib/MailScanner/Quarantine.pm
+--- mailscanner-4.68.8~/lib/MailScanner/Quarantine.pm	2008-12-22 20:51:38.000000000 +0100
++++ mailscanner-4.68.8/lib/MailScanner/Quarantine.pm	2008-12-22 22:48:15.000000000 +0100
+@@ -36,6 +36,7 @@
+ no  strict 'subs'; # Allow bare words for parameter %'s
+ 
+ use File::Copy;
++use File::Temp qw ( tempfile tempdir );
+ 
+ use vars qw($VERSION);
+ 
+@@ -80,11 +81,9 @@
+ 
+   # Create a test file to try with chown
+   my($testfn, $testfh, $worked);
+-  $testfn = MailScanner::Config::Value('lockfiledir') || '/tmp';
+-  $testfn .= "/MailScanner.ownertest.$$";
+-  $testfh = new FileHandle;
+-  $testfh->open(">$testfn") or
+-    MailScanner::Log::WarnLog('Could not test file ownership abilities on %s, please delete the file', $testfn);
++  #MailScanner::Config::Value('lockfiledir') || '/var/spool/MailScanner/incoming/Locks';
++  ($testfh, $testfn) = tempfile('MS.ownertest.XXXXXX', DIR => '/tmp')
++    or MailScanner::Log::WarnLog('Could not test file ownership abilities on %s, please delete the file', $testfn);
+   print $testfh "Testing file owner and group permissions for MailScanner\n";
+   $testfh->close;
+ 
+diff -urNad mailscanner-4.68.8~/lib/MailScanner/SA.pm mailscanner-4.68.8/lib/MailScanner/SA.pm
+--- mailscanner-4.68.8~/lib/MailScanner/SA.pm	2008-12-22 22:48:14.000000000 +0100
++++ mailscanner-4.68.8/lib/MailScanner/SA.pm	2008-12-22 22:48:15.000000000 +0100
+@@ -69,6 +69,22 @@
+ my $VirusesCacheLife  = 48*60*60; # Lifetime of viruses from last seen
+ my $ExpireFrequency   = 10*60;    # How often to run the expiry of the cache
+ 
++sub CreateTempDir {
++  my($runasuser,$satmpdir) = @_;
++
++  # Create the $TMPDIR for SpamAssassin if necessary, then check we can
++  # write to it. If not, change to /tmp.
++  lstat $satmpdir;
++  unless (-d _) {
++    unlink $satmpdir;
++    mkdir $satmpdir or warn "Could not create SpamAssassin temporary directory $satmpdir, $!";
++  }
++  chmod 0700, $satmpdir unless $satmpdir =~ /^\.tmp/;
++  chown $runasuser, -1, $satmpdir;
++
++  $ENV{'TMPDIR'} = $satmpdir;
++}
++
+ sub initialise {
+   my($RebuildBayes, $WantLintOnly) = @_; # Start by rebuilding the Bayes database?
+ 
+diff -urNad mailscanner-4.68.8~/lib/MailScanner/SweepViruses.pm mailscanner-4.68.8/lib/MailScanner/SweepViruses.pm
+--- mailscanner-4.68.8~/lib/MailScanner/SweepViruses.pm	2008-12-22 20:51:38.000000000 +0100
++++ mailscanner-4.68.8/lib/MailScanner/SweepViruses.pm	2008-12-22 22:48:15.000000000 +0100
+@@ -81,7 +81,7 @@
+ my %Scanners = (
+   generic => {
+     Name		=> 'Generic',
+-    Lock		=> 'GenericBusy.lock',
++    Lock		=> 'genericBusy.lock',
+     CommonOptions	=> '',
+     DisinfectOptions	=> '-disinfect',
+     ScanOptions		=> '',
+@@ -92,7 +92,7 @@
+   },
+   sophossavi => {
+     Name		=> 'SophosSAVI',
+-    Lock		=> 'SophosBusy.lock',
++    Lock		=> 'sophosBusy.lock',
+     # In next line, '-ss' makes it work nice and quietly
+     CommonOptions	=> '',
+     DisinfectOptions	=> '',
+@@ -104,7 +104,7 @@
+   },
+   sophos => {
+     Name		=> 'Sophos',
+-    Lock		=> 'SophosBusy.lock',
++    Lock		=> 'sophosBusy.lock',
+     # In next line, '-ss' makes it work nice and quietly
+     CommonOptions	=> '-sc -f -all -rec -ss -archive -cab -loopback ' .
+                            '--no-follow-symlinks --no-reset-atime -TNEF',
+@@ -117,7 +117,7 @@
+   },
+   mcafee		=> {
+     Name		=> 'McAfee',
+-    Lock		=> 'McAfeeBusy.lock',
++    Lock		=> 'mcafeeBusy.lock',
+     CommonOptions	=> '--recursive --ignore-links --analyze --mime ' .
+                            '--secure --noboot',
+     DisinfectOptions	=> '--clean',
+@@ -129,7 +129,7 @@
+   },
+   command		=> {
+     Name		=> 'Command',
+-    Lock		=> 'CommandBusy.lock',
++    Lock		=> 'commandBusy.lock',
+     CommonOptions	=> '-packed -archive',
+     DisinfectOptions	=> '-disinf',
+     ScanOptions		=> '',
+@@ -140,7 +140,7 @@
+   },
+   etrust	=> {
+     Name		=> 'eTrust',
+-    Lock		=> 'eTrustBusy.lock',
++    Lock		=> 'etrustBusy.lock',
+     CommonOptions	=> '-nex -arc -mod reviewer -spm h ',
+     DisinfectOptions	=> '-act cure -sca mf',
+     ScanOptions		=> '',
+@@ -151,7 +151,7 @@
+   },
+   inoculate	=> {
+     Name		=> 'Inoculate',
+-    Lock		=> 'InoculateBusy.lock',
++    Lock		=> 'inoculateBusy.lock',
+     CommonOptions	=> '-nex -arc -mod reviewer -spm h ',
+     DisinfectOptions	=> '-act cure -sca mf',
+     ScanOptions		=> '',
+@@ -162,7 +162,7 @@
+   },
+   inoculan	=> {
+     Name		=> 'Inoculan',
+-    Lock		=> 'InoculanBusy.lock',
++    Lock		=> 'inoculanBusy.lock',
+     CommonOptions	=> '-nex -rev ',
+     DisinfectOptions	=> '-nex -cur',
+     ScanOptions		=> '',
+@@ -173,7 +173,7 @@
+   },
+   "kaspersky-4.5"	=> {
+     Name		=> 'Kaspersky',
+-    Lock		=> 'KasperskyBusy.lock',
++    Lock		=> 'kasperskyBusy.lock',
+     CommonOptions	=> '',
+     DisinfectOptions	=> '-i2',
+     ScanOptions		=> '-i0',
+@@ -184,7 +184,7 @@
+   },
+   kaspersky	=> {
+     Name		=> 'Kaspersky',
+-    Lock		=> 'KasperskyBusy.lock',
++    Lock		=> 'kasperskyBusy.lock',
+     CommonOptions	=> '',
+     DisinfectOptions	=> '-- -I2',
+     ScanOptions		=> '-I0',
+@@ -195,7 +195,7 @@
+   },
+   kavdaemonclient	=> {
+     Name		=> 'KavDaemon',
+-    Lock		=> 'KavDaemonClientBusy.lock',
++    Lock		=> 'kasperskyBusy.lock',
+     CommonOptions	=> '',
+     DisinfectOptions	=> '-- -I2',
+     ScanOptions		=> '',
+@@ -206,7 +206,7 @@
+   },
+   "f-secure"	=> {
+     Name		=> 'F-Secure',
+-    Lock		=> 'FSecureBusy.lock',
++    Lock		=> 'f-secureBusy.lock',
+     CommonOptions	=> '--dumb --archive',
+     DisinfectOptions	=> '--auto --disinf',
+     ScanOptions		=> '',
+@@ -217,7 +217,7 @@
+   },
+   "f-prot"	=> {
+     Name		=> 'F-Prot',
+-    Lock		=> 'FProtBusy.lock',
++    Lock		=> 'f-protBusy.lock',
+     CommonOptions	=> '-old -archive -dumb',
+     DisinfectOptions	=> '-disinf -auto',
+     ScanOptions		=> '',
+@@ -228,7 +228,7 @@
+   },
+   "f-prot-6"	=> {
+     Name		=> 'F-Prot6',
+-    Lock		=> 'FProt6Busy.lock',
++    Lock		=> 'f-prot-6Busy.lock',
+     CommonOptions	=> '-s 4 --adware',
+     DisinfectOptions	=> '--disinfect --macros_safe',
+     ScanOptions		=> '--report',
+@@ -239,7 +239,7 @@
+   },
+   "f-protd-6"	=> {
+     Name		=> 'F-Protd6',
+-    Lock		=> 'FProtd6Busy.lock',
++    Lock		=> 'f-prot-6Busy.lock',
+     CommonOptions	=> '',
+     DisinfectOptions	=> '',
+     ScanOptions		=> '',
+@@ -250,7 +250,7 @@
+   },
+   nod32		=> {
+     Name		=> 'Nod32',
+-    Lock		=> 'Nod32Busy.lock',
++    Lock		=> 'nod32Busy.lock',
+     CommonOptions	=> '-log- -all',
+     DisinfectOptions	=> '-clean -delete',
+     ScanOptions		=> '',
+@@ -261,7 +261,7 @@
+   },
+   "nod32-1.99"		=> {
+     Name		=> 'Nod32',
+-    Lock		=> 'Nod32Busy.lock',
++    Lock		=> 'nod32Busy.lock',
+     CommonOptions	=> '--arch --all -b',
+     DisinfectOptions	=> '--action clean --action-uncl none',
+     ScanOptions		=> '',
+@@ -272,7 +272,7 @@
+   },
+   "antivir"	=> {
+     Name		=> 'AntiVir',
+-    Lock		=> 'AntiVirBusy.lock',
++    Lock		=> 'antivirBusy.lock',
+     CommonOptions	=> '-allfiles -s -noboot -rs -z',
+     DisinfectOptions	=> '-e -ren',
+     ScanOptions		=> '',
+@@ -283,7 +283,7 @@
+   },
+   "panda"	=> {
+     Name		=> 'Panda',
+-    Lock                => 'PandaBusy.lock',
++    Lock                => 'pandaBusy.lock',
+     CommonOptions       => '-nor -nos -nob -heu -eng -aex -auto -cmp',
+     DisinfectOptions    => '-clv',
+     ScanOptions         => '-nor',
+@@ -294,7 +294,7 @@
+   },
+   "rav"	=> {
+     Name		=> 'Rav',
+-    Lock		=> 'RavBusy.lock',
++    Lock		=> 'ravBusy.lock',
+     CommonOptions	=> '--all --mail --archive',
+     DisinfectOptions	=> '--clean',
+     ScanOptions		=> '',
+@@ -305,7 +305,7 @@
+   },
+   "clamavmodule" => {
+     Name                => 'ClamAVModule',
+-    Lock                => 'ClamAVBusy.lock',
++    Lock                => 'clamavBusy.lock',
+     CommonOptions       => '',
+     DisinfectOptions    => '',
+     ScanOptions         => '',
+@@ -316,7 +316,7 @@
+   },
+   "clamd"  => {
+     Name                => 'Clamd',
+-    Lock                => 'ClamDBusy.lock',
++    Lock                => 'clamavBusy.lock',
+     CommonOptions       => '',
+     DisinfectOptions    => '',
+     ScanOptions         => '',
+@@ -327,7 +327,7 @@
+   },
+   "clamav"  => {
+     Name		=> 'ClamAV',
+-    Lock                => 'ClamAVBusy.lock',
++    Lock                => 'clamavBusy.lock',
+     CommonOptions       => '-r --no-summary --stdout',
+     DisinfectOptions    => '',
+     ScanOptions         => '',
+@@ -338,7 +338,7 @@
+   },
+   "trend"   => {
+     Name		=> 'Trend',
+-    Lock                => 'TrendBusy.lock',
++    Lock                => 'trendBusy.lock',
+     CommonOptions       => '-a -za -r',
+     DisinfectOptions    => '-c',
+     ScanOptions         => '',
+@@ -349,7 +349,7 @@
+   },
+   "bitdefender"   => {
+     Name		=> 'Bitdefender',
+-    Lock                => 'BitdefenderBusy.lock',
++    Lock                => 'bitdefenderBusy.lock',
+     CommonOptions       => '--arc --mail --all',
+     DisinfectOptions    => '--disinfect',
+     ScanOptions         => '',
+@@ -360,7 +360,7 @@
+   },
+   "drweb"   => {
+     Name		=> 'DrWeb',
+-    Lock                => 'drweb.lock',
++    Lock                => 'drwebBusy.lock',
+     CommonOptions       => '-ar -fm -ha- -fl- -ml -sd -up',
+     DisinfectOptions    => '-cu',
+     ScanOptions         => '',
+@@ -371,7 +371,7 @@
+   },
+   "norman"   => {
+     Name		=> 'Norman',
+-    Lock                => 'NormanBusy.lock',
++    Lock                => 'normanBusy.lock',
+     CommonOptions       => '-c -sb:1 -s -u',
+     DisinfectOptions    => '-cl:2',
+     ScanOptions         => '',
+@@ -382,7 +382,7 @@
+   },
+   "css" => {
+     Name                => 'SYMCScan',
+-    Lock                => 'SYMCScan.lock',
++    Lock                => 'symscanengineBusy.lock',
+     CommonOptions       => '',
+     DisinfectOptions    => '',
+     ScanOptions         => '',
+@@ -393,7 +393,7 @@
+   },
+   "avg"   => {
+     Name                => 'Avg',
+-    Lock                => 'AvgBusy.lock',
++    Lock                => 'avgBusy.lock',
+     CommonOptions       => '-arc', # Remove by Chris Richardson:  -ext=*',
+     DisinfectOptions    => '',
+     ScanOptions         => '',
+@@ -404,7 +404,7 @@
+   },
+   "vexira"   => {
+     Name                => 'Vexira',
+-    Lock                => 'VexiraBusy.lock',
++    Lock                => 'vexiraBusy.lock',
+     #CommonOptions       => '--allfiles -s -z -noboot -nombr -r1 -rs -lang=EN --alltypes',
+     #DisinfectOptions    => '-e',
+     CommonOptions       => '-qq --scanning=full',
+@@ -417,7 +417,7 @@
+   },
+   "symscanengine"	=> {
+     Name		=> 'SymantecScanEngine',
+-    Lock		=> 'SymScanEngineBusy.lock',
++    Lock		=> 'symscanengineBusy.lock',
+     CommonOptions	=> '-details -recurse',
+     DisinfectOptions	=> '-mode scanrepair',
+     ScanOptions		=> '-mode scan',
+@@ -428,7 +428,7 @@
+   },
+   "avast"		=> {
+     Name		=> 'Avast',
+-    Lock		=> 'Avast.lock',
++    Lock		=> 'avastBusy.lock',
+     CommonOptions	=> '-n -t=A',
+     DisinfectOptions	=> '-p=3',
+     ScanOptions		=> '',
+@@ -439,7 +439,7 @@
+   },
+   "avastd"		=> {
+     Name		=> 'AvastDaemon',
+-    Lock		=> 'AvastDaemon.lock',
++    Lock		=> 'avastBusy.lock',
+     CommonOptions	=> '-n',
+     DisinfectOptions	=> '',
+     ScanOptions		=> '',
+diff -urNad mailscanner-4.68.8~/lib/MailScanner/TNEF.pm mailscanner-4.68.8/lib/MailScanner/TNEF.pm
+--- mailscanner-4.68.8~/lib/MailScanner/TNEF.pm	2008-12-22 20:51:38.000000000 +0100
++++ mailscanner-4.68.8/lib/MailScanner/TNEF.pm	2008-12-22 22:48:15.000000000 +0100
+@@ -36,6 +36,7 @@
+ no  strict 'subs'; # Allow bare words for parameter %'s
+ 
+ use DirHandle;
++use File::Temp qw/ tempfile tempdir /;
+ use POSIX qw(:signal_h setsid); # For Solaris 9 SIG bug workaround
+ 
+ use vars qw($VERSION);
+@@ -125,10 +126,10 @@
+   my($fh, $filename, %parms);
+ 
+   # Make the temporary tnef files be created under /tmp for easy removal.
+-  mkdir "/tmp/tnef.$$", 0777;
+-  chmod 0700, "/tmp/tnef.$$";
++  my $tempdir = tempdir();
++  chmod 0700, $tempdir; # "/tmp/tnef.$$";
+   %parms = ( ignore_checksum => "true",
+-             output_dir      => "/tmp/tnef.$$",
++             output_dir      => $tempdir,
+              output_to_core  => "NONE" );
+   my $tnef = Convert::TNEF->read_in("$dir/$tnefname", \%parms);
+   if ($tnef) {
+@@ -186,7 +187,7 @@
+     undef $tnef;
+     $message->{foundtnefattachments} = 1;
+     #$message->{entity}->dump_skeleton();
+-    system("rm -rf /tmp/tnef.$$");
++    system("rm -rf $tempdir"); # /tmp/tnef.$$");
+     MailScanner::Log::InfoLog("Message %s added TNEF contents %s",
+                               $message->{id}, join(',', @replacements))
+       if @replacements;
+@@ -194,7 +195,7 @@
+   } else {
+     # It failed
+     undef $tnef;
+-    system("rm -rf /tmp/tnef.$$");
++    system("rm -rf $tempdir"); # /tmp/tnef.$$");
+     return 1 if MailScanner::Config::Value('deliverunparsabletnef',$message);
+     return 0;
+   }
+@@ -326,7 +327,8 @@
+       $message->{entity}->attach(Type => $type,
+                                  Encoding => $encoding,
+                                  Disposition => "attachment",
+-                                 Filename => $safename,
++                                 # Use original name: $safename,
++                                 Filename => $unpacked,
+                                  Path => "$dir/$safename");
+     }
+     $message->{bodymodified} = 1;
+diff -urNad mailscanner-4.68.8~/lib/MailScanner/WorkArea.pm mailscanner-4.68.8/lib/MailScanner/WorkArea.pm
+--- mailscanner-4.68.8~/lib/MailScanner/WorkArea.pm	2008-12-22 20:51:38.000000000 +0100
++++ mailscanner-4.68.8/lib/MailScanner/WorkArea.pm	2008-12-22 22:48:15.000000000 +0100
+@@ -37,6 +37,7 @@
+ 
+ use DirHandle;
+ use File::Path;
++use File::Temp qw/ tempfile tempdir /;
+ use Cwd 'abs_path';
+ 
+ use vars qw($VERSION);
+@@ -81,11 +82,9 @@
+ 
+   # Create a test file to try with chown
+   my($testfn, $testfh, $worked);
+-  $testfn = MailScanner::Config::Value('lockfiledir') || '/tmp';
+-  $testfn .= "/MailScanner.ownertest.$$";
+-  $testfh = new FileHandle;
+-  $testfh->open(">$testfn") or
+-    MailScanner::Log::WarnLog('Could not test file ownership abilities on %s, please delete the file', $testfn);
++  #MailScanner::Config::Value('lockfiledir') || '/var/spool/MailScanner/incoming/Locks';
++  ($testfh, $testfn) = tempfile('MS.ownertest.XXXXXX', DIR => '/tmp')
++    or MailScanner::Log::WarnLog('Could not test file ownership abilities on %s, please delete the file', $testfn);
+   print $testfh "Testing file owner and group permissions for MailScanner\n";
+   $testfh->close;
+ 
+@@ -290,6 +289,12 @@
+   rmtree($IdList, 0, 1);
+ }
+ 
++sub DeleteFile {
++  my $this = shift;
++  my($message, $attach) = @_;
++  unlink $this->{dir} . '/' . $message->{id} . '/' . $attach;
++}
++
+ 
+ # Change current directory to the one containing the attachments
+ # for the message we are passed.
+diff -urNad mailscanner-4.68.8~/lib/antivir-autoupdate mailscanner-4.68.8/lib/antivir-autoupdate
+--- mailscanner-4.68.8~/lib/antivir-autoupdate	2008-12-22 20:51:38.000000000 +0100
++++ mailscanner-4.68.8/lib/antivir-autoupdate	2008-12-22 22:48:15.000000000 +0100
+@@ -12,7 +12,7 @@
+ $AntiVirCommand = "$PackageDir/antivir";
+ $AntiVirUpdateCommand = "$AntiVirCommand --update";
+ 
+-$LockFile = "/tmp/AntiVirBusy.lock";
++$LockFile = shift || "/var/spool/MailScanner/incoming/Locks/antivirBusy.lock";
+ 
+ $LOCK_SH = 1;
+ $LOCK_EX = 2;
+@@ -70,7 +70,6 @@
+ 
+ sub UnlockAntiVir {
+ 	print LOCK "Unlocked after updating AntiVir definitions by $$\n";
+-	unlink $LockFile;
+ 	flock(LOCK, $LOCK_UN);
+ 	close LOCK;
+ }
+diff -urNad mailscanner-4.68.8~/lib/avast-autoupdate mailscanner-4.68.8/lib/avast-autoupdate
+--- mailscanner-4.68.8~/lib/avast-autoupdate	2008-12-22 20:51:38.000000000 +0100
++++ mailscanner-4.68.8/lib/avast-autoupdate	2008-12-22 22:48:15.000000000 +0100
+@@ -6,6 +6,7 @@
+ #
+ 
+ use Sys::Syslog;
++use File::Temp qw{tempfile};
+ 
+ # If you have a web proxy or cache server, put its value in the next line
+ # in the syntax "full.host.name:port".
+@@ -13,11 +14,11 @@
+ 
+ $PackageDir = shift || "/usr";
+ 
+-$LogFile = "/tmp/Avast.update.log";
++(undef, $LogFile) = tempfile("/tmp/Avast.update.log.XXXXXX");
+ 
+ $AvastUpdateCommand = "$PackageDir/bin/avastvpsupdate.sh";
+ 
+-$LockFile = "/tmp/AvastBusy.lock";
++$LockFile = shift || "/var/spool/MailScanner/incoming/Locks/avastBusy.lock";
+ 
+ $LOCK_SH = 1;
+ $LOCK_EX = 2;
+@@ -65,7 +66,6 @@
+ 
+ sub UnlockAvast {
+ 	print LOCK "Unlocked after updating Avast definitions by $$\n";
+-	unlink $LockFile;
+ 	flock(LOCK, $LOCK_UN);
+ 	close LOCK;
+ }
+diff -urNad mailscanner-4.68.8~/lib/avg-autoupdate mailscanner-4.68.8/lib/avg-autoupdate
+--- mailscanner-4.68.8~/lib/avg-autoupdate	2008-12-22 20:51:38.000000000 +0100
++++ mailscanner-4.68.8/lib/avg-autoupdate	2008-12-22 22:48:15.000000000 +0100
+@@ -31,9 +31,12 @@
+ #      SO17 1BJ
+ #      United Kingdom
+ #
+-# $Id: avg-autoupdate 2362 2004-04-03 12:50:00Z jkf $
++# $Id: avg-autoupdate 4597 2008-12-11 01:50:19Z sysjkf $
+ 
+ Root=$1
++# Remove Root
++shift
++# Remote lockfile
+ shift
+ exec $Root/bin/avgupdate  "$@" --online --priority=3 --no-log --no-progress --no-diff --no-daemons "$@" > /dev/null
+ exit 1
+diff -urNad mailscanner-4.68.8~/lib/bitdefender-autoupdate mailscanner-4.68.8/lib/bitdefender-autoupdate
+--- mailscanner-4.68.8~/lib/bitdefender-autoupdate	2008-12-22 20:51:38.000000000 +0100
++++ mailscanner-4.68.8/lib/bitdefender-autoupdate	2008-12-22 22:48:15.000000000 +0100
+@@ -109,6 +109,8 @@
+ 
+ my $PackageDir = shift || "/opt/bdc";
+ 
++$LockFile = shift || "/var/spool/MailScanner/incoming/Locks/bitdefenderBusy.lock";
++
+ # This is the maximum time allowed for the bdc --update command to run.
+ my $MaximumTime = 60*20; # 20 minutes
+ 
+@@ -160,8 +162,6 @@
+ # JKF This should always be over-written later, see JKF comments
+ $bdcBinary = $bitDefenderPath . $bitDefBinary ; # full path to binary
+ 
+-$LockFile = "/tmp/BitDefenderBusy.lock";
+-
+ $LOCK_SH = 1;
+ $LOCK_EX = 2;
+ $LOCK_NB = 4;
+@@ -508,7 +508,6 @@
+ 
+ sub UnlockBitDefender {
+         print LOCK "Unlocked after updating BitDefender definitions by $$\n";
+-        unlink $LockFile;
+         flock(LOCK, $LOCK_UN);
+         close LOCK;
+        # &updateLog ( "Unlocked after updating BitDefender definitions by $$\n");
+diff -urNad mailscanner-4.68.8~/lib/bitdefender-wrapper mailscanner-4.68.8/lib/bitdefender-wrapper
+--- mailscanner-4.68.8~/lib/bitdefender-wrapper	2008-12-22 20:51:38.000000000 +0100
++++ mailscanner-4.68.8/lib/bitdefender-wrapper	2008-12-22 22:48:15.000000000 +0100
+@@ -33,7 +33,7 @@
+ prog=bdc
+ extras=''
+ 
+-LogFile=/tmp/log.bdc.$$
++LogFile=`mktemp /tmp/log.bdc.XXXXXX` || exit 1
+ 
+ if [ -x ${PackageDir}/bdscan ]; then
+   # Version 7.5 is installed
+diff -urNad mailscanner-4.68.8~/lib/clamav-autoupdate mailscanner-4.68.8/lib/clamav-autoupdate
+--- mailscanner-4.68.8~/lib/clamav-autoupdate	2008-12-22 20:51:38.000000000 +0100
++++ mailscanner-4.68.8/lib/clamav-autoupdate	2008-12-22 22:48:15.000000000 +0100
+@@ -6,6 +6,7 @@
+ #
+ 
+ use Sys::Syslog;
++use File::Temp qw{tempfile};
+ 
+ # If you have a web proxy or cache server, put its value in the next line
+ # in the syntax "full.host.name:port".
+@@ -13,11 +14,11 @@
+ 
+ $PackageDir = shift || "/usr/local";
+ 
+-$LogFile = "/tmp/ClamAV.update.log";
++(undef, $LogFile) = tempfile("/tmp/ClamAV.update.log.XXXXXX");
+ 
+ $ClamUpdateCommand = "$PackageDir/bin/freshclam";
+ 
+-$LockFile = "/tmp/ClamAVBusy.lock";
++$LockFile = shift || "/var/spool/MailScanner/incoming/Locks/clamavBusy.lock";
+ 
+ $LOCK_SH = 1;
+ $LOCK_EX = 2;
+@@ -73,7 +74,6 @@
+ 
+ sub UnlockClamAV {
+ 	print LOCK "Unlocked after updating ClamAV definitions by $$\n";
+-	unlink $LockFile;
+ 	flock(LOCK, $LOCK_UN);
+ 	close LOCK;
+ }
+diff -urNad mailscanner-4.68.8~/lib/clamav-wrapper mailscanner-4.68.8/lib/clamav-wrapper
+--- mailscanner-4.68.8~/lib/clamav-wrapper	2008-12-22 20:51:38.000000000 +0100
++++ mailscanner-4.68.8/lib/clamav-wrapper	2008-12-22 22:48:15.000000000 +0100
+@@ -51,7 +51,7 @@
+ 
+ # You may want to check this script for bash-isms
+ 
+-TempDir="/tmp/clamav.$$"
++TempDir=`mktemp -d /tmp/clamav.XXXXXX` || exit 1
+ ClamUser="clamav"
+ ClamGroup="clamav"
+ 
+@@ -139,15 +139,6 @@
+ PATH=$PATH:/usr/ucb
+ export PATH
+ 
+-# Check if the tmpdir exists, if so delete so we start with a clean slate
+-if [ -x "${TempDir}" ]; then
+-	rm -rf ${TempDir} >/dev/null 2>&1
+-fi
+-
+-# Make the Temp dir
+-umask 0077
+-mkdir "${TempDir}" >/dev/null 2>&1
+-
+ # In case we get interupted....
+ trap "rm -rf ${TempDir}" EXIT
+ 
+diff -urNad mailscanner-4.68.8~/lib/css-autoupdate mailscanner-4.68.8/lib/css-autoupdate
+--- mailscanner-4.68.8~/lib/css-autoupdate	2008-12-22 20:51:38.000000000 +0100
++++ mailscanner-4.68.8/lib/css-autoupdate	2008-12-22 22:48:15.000000000 +0100
+@@ -5,7 +5,7 @@
+ $CSSDir = shift || "/opt/SYMCScan";
+ $CSSUpdateCommand="$CSSDir/bin/liveupdate.sh";
+ 
+-$LockFile = "/tmp/SYMCScan.lock";
++$LockFile = shift || "/var/spool/MailScanner/incoming/Locks/cssBusy.lock";
+ 
+ $LOCK_SH = 1;
+ $LOCK_EX = 2;
+@@ -62,7 +62,6 @@
+ 
+ sub UnlockCSS {
+ 	print LOCK "Unlocked after updating CSS patterns by $$\n";
+-	unlink $LockFile;
+ 	flock(LOCK, $LOCK_UN);
+ 	close LOCK;
+ }
+diff -urNad mailscanner-4.68.8~/lib/esets-autoupdate mailscanner-4.68.8/lib/esets-autoupdate
+--- mailscanner-4.68.8~/lib/esets-autoupdate	2008-12-22 20:51:38.000000000 +0100
++++ mailscanner-4.68.8/lib/esets-autoupdate	2008-12-22 22:48:15.000000000 +0100
+@@ -5,7 +5,7 @@
+ $esetsRoot  = shift || "/usr/local/esets";
+ 
+ $esetsAuth  = "esets.auth";
+-$LockFile = "/tmp/esetsBusy.lock";
++$LockFile = shift || "/var/spool/MailScanner/incoming/Locks/esetsBusy.lock";
+ 
+ $LOCK_SH = 1;
+ $LOCK_EX = 2;
+@@ -85,7 +85,6 @@
+ 
+ sub Unlock {
+ 	print LOCK "Unlocked after updating virus definitions by $$\n";
+-	unlink $LockFile;
+ 	flock(LOCK, $LOCK_UN);
+ 	close LOCK;
+ }
+diff -urNad mailscanner-4.68.8~/lib/etrust-autoupdate mailscanner-4.68.8/lib/etrust-autoupdate
+--- mailscanner-4.68.8~/lib/etrust-autoupdate	2008-12-22 20:51:38.000000000 +0100
++++ mailscanner-4.68.8/lib/etrust-autoupdate	2008-12-22 22:48:15.000000000 +0100
+@@ -9,7 +9,7 @@
+ 
+ $PackageDir = shift || "/opt/CA/eTrustITM";
+ 
+-$LockFile = "/tmp/eTrustBusy.lock";
++$LockFile = shift || "/var/spool/MailScanner/incoming/Locks/etrustBusy.lock";
+ 
+ $LOCK_SH = 1;
+ $LOCK_EX = 2;
+@@ -134,7 +134,6 @@
+ 
+ sub UnlockAV {
+ 	print LOCK "Unlocked after updating eTrust definitions by $$\n";
+-	unlink $LockFile;
+ 	flock(LOCK, $LOCK_UN);
+ 	close LOCK;
+ }
+diff -urNad mailscanner-4.68.8~/lib/f-prot-6-autoupdate mailscanner-4.68.8/lib/f-prot-6-autoupdate
+--- mailscanner-4.68.8~/lib/f-prot-6-autoupdate	2008-12-22 20:51:38.000000000 +0100
++++ mailscanner-4.68.8/lib/f-prot-6-autoupdate	2008-12-22 22:48:15.000000000 +0100
+@@ -33,6 +33,7 @@
+ use Sys::Syslog;
+ use FileHandle;
+ use IO::File;
++use File::Temp qw{tempfile};
+ # Stop syslogd from needing external access (or -r)
+ eval { Sys::Syslog::setlogsock('unix'); };
+ 
+@@ -49,8 +50,8 @@
+ #
+ ####################################
+ 
+-$LockFile = "/tmp/FProt6Busy.lock";
+ $PackageDir = shift || "/opt/f-prot";
++$LockFile = "/var/spool/MailScanner/incoming/Locks/f-prot-6Busy.lock";
+ 
+ $LOCK_SH = 1;
+ $LOCK_EX = 2;
+@@ -67,7 +68,7 @@
+ #
+ $command = "$PackageDir/fpupdate";
+ $command .= " --proxy $Proxy --proxy-username $ProxyUsername --proxy-password $ProxyPassword" if $Proxy;
+-my $logfile = "/tmp/f-prot-6-update-$$";
++my (undef, $logfile) = tempdir("/tmp/f-prot-6-update-XXXXXX");
+ $command .= " >$logfile 2>&1";
+ 
+ #
+@@ -142,7 +143,6 @@
+ sub UnlockFProt {
+ 	return unless $FProtIsLocked;
+ 	print LOCK "Unlocked after updating F-Prot-6 signature files by $$\n";
+-	unlink $LockFile;
+ 	flock(LOCK, $LOCK_UN);
+ 	close LOCK;
+ }
+diff -urNad mailscanner-4.68.8~/lib/f-prot-autoupdate mailscanner-4.68.8/lib/f-prot-autoupdate
+--- mailscanner-4.68.8~/lib/f-prot-autoupdate	2008-12-22 20:51:38.000000000 +0100
++++ mailscanner-4.68.8/lib/f-prot-autoupdate	2008-12-22 22:48:15.000000000 +0100
+@@ -3,7 +3,7 @@
+ #   MailScanner - SMTP E-Mail Virus Scanner
+ #   Copyright (C) 2002  Julian Field
+ #
+-#   $Id: f-prot-autoupdate 4143 2007-08-20 17:14:40Z sysjkf $
++#   $Id: f-prot-autoupdate 4605 2008-12-11 12:17:05Z sysjkf $
+ #
+ #   This program is free software; you can redistribute it and/or modify
+ #   it under the terms of the GNU General Public License as published by
+@@ -59,7 +59,7 @@
+ #$FallbackServer = 'http://updates.f-prot.com/files/';
+ $FallbackServer = 'ftp://ftp.f-prot.com/pub/';
+ 
+-$LockFile = "/tmp/FProtBusy.lock";
++$LockFile = shift || "/var/spool/MailScanner/incoming/Locks/f-protBusy.lock";
+ 
+ $LOCK_SH = 1;
+ $LOCK_EX = 2;
+@@ -374,7 +374,6 @@
+ sub UnlockFProt {
+ 	return unless $FProtIsLocked;
+ 	print LOCK "Unlocked after updating F-Prot virus files by $$\n";
+-	unlink $LockFile;
+ 	flock(LOCK, $LOCK_UN);
+ 	close LOCK;
+ }
+diff -urNad mailscanner-4.68.8~/lib/f-secure-autoupdate mailscanner-4.68.8/lib/f-secure-autoupdate
+--- mailscanner-4.68.8~/lib/f-secure-autoupdate	2008-12-22 20:51:38.000000000 +0100
++++ mailscanner-4.68.8/lib/f-secure-autoupdate	2008-12-22 22:48:15.000000000 +0100
+@@ -31,9 +31,12 @@
+ #      SO17 1BJ
+ #      United Kingdom
+ #
+-# $Id: f-secure-autoupdate 1868 2003-08-25 16:39:32Z jkf $
++# $Id: f-secure-autoupdate 4597 2008-12-11 01:50:19Z sysjkf $
+ 
+ Root=$1
++# Dispose of Root
++shift
++# Dispose of Lock file name
+ shift
+ exec $Root/bin/dbupdate "$@"
+ 
+diff -urNad mailscanner-4.68.8~/lib/f-secure-wrapper mailscanner-4.68.8/lib/f-secure-wrapper
+--- mailscanner-4.68.8~/lib/f-secure-wrapper	2008-12-22 20:51:38.000000000 +0100
++++ mailscanner-4.68.8/lib/f-secure-wrapper	2008-12-22 22:48:15.000000000 +0100
+@@ -33,7 +33,7 @@
+ #      SO17 1BJ
+ #      United Kingdom
+ #
+-# $Id: f-secure-wrapper 4192 2007-10-02 17:54:26Z sysjkf $
++# $Id: f-secure-wrapper 4534 2008-09-01 11:33:51Z sysjkf $
+ 
+ 
+ # Look to see what version we have got installed.
+@@ -48,7 +48,7 @@
+ if [ -f $FSAV_CONF ] && grep -i '^daemondatabasedirectory' $FSAV_CONF  >/dev/null
+ then
+   PackageDir=$Root/bin
+-  ScanOptions="--riskware=on --virus-action1=report --virus-action2=none --riskware-action1=report --riskware-action2=none --skiplarge=no --databasedirectory=/var/opt/f-secure/fssp/databases"
++  ScanOptions="--riskware=on --scanexecutables=on --virus-action1=report --virus-action2=none --riskware-action1=report --riskware-action2=none --skiplarge=no --databasedirectory=/var/opt/f-secure/fssp/databases"
+ else
+   # FSAV version 4.6x
+   FSAV_CONF=/etc/opt/f-secure/fsav/fsav.conf
+diff -urNad mailscanner-4.68.8~/lib/generic-autoupdate mailscanner-4.68.8/lib/generic-autoupdate
+--- mailscanner-4.68.8~/lib/generic-autoupdate	2008-12-22 20:51:38.000000000 +0100
++++ mailscanner-4.68.8/lib/generic-autoupdate	2008-12-22 22:48:15.000000000 +0100
+@@ -7,7 +7,7 @@
+ 
+ $GenericRoot = shift;
+ 
+-$LockFile = "/tmp/GenericBusy.lock";
++$LockFile = shift || "/var/spool/MailScanner/incoming/Locks/genericBusy.lock";
+ 
+ $LOCK_SH = 1;
+ $LOCK_EX = 2;
+@@ -45,7 +45,6 @@
+ 
+ sub UnlockGeneric {
+ 	print LOCK "Unlocked after updating Generic virus scanner by $$\n";
+-	unlink $LockFile;
+ 	flock(LOCK, $LOCK_UN);
+ 	close LOCK;
+ }
+diff -urNad mailscanner-4.68.8~/lib/inoculan-autoupdate mailscanner-4.68.8/lib/inoculan-autoupdate
+--- mailscanner-4.68.8~/lib/inoculan-autoupdate	2008-12-22 20:51:38.000000000 +0100
++++ mailscanner-4.68.8/lib/inoculan-autoupdate	2008-12-22 22:48:15.000000000 +0100
+@@ -10,7 +10,7 @@
+ 
+ $InoculanDir = shift || "/usr/local/inoculan";
+ 
+-$LockFile = "/tmp/InoculanBusy.lock";
++$LockFile = shift || "/var/spool/MailScanner/incoming/Locks/inoculanBusy.lock";
+ 
+ $LOCK_SH = 1;
+ $LOCK_EX = 2;
+@@ -44,7 +44,6 @@
+ 
+ sub UnlockInoculan {
+   print LOCK "Unlocked after updating inoculan patterns by $$\n";
+-  unlink $LockFile;
+   flock(LOCK, $LOCK_UN);
+   close LOCK;
+ }
+diff -urNad mailscanner-4.68.8~/lib/kaspersky-autoupdate mailscanner-4.68.8/lib/kaspersky-autoupdate
+--- mailscanner-4.68.8~/lib/kaspersky-autoupdate	2008-12-22 20:51:38.000000000 +0100
++++ mailscanner-4.68.8/lib/kaspersky-autoupdate	2008-12-22 22:48:15.000000000 +0100
+@@ -8,7 +8,7 @@
+ $KavUpdateBinary  = "$PackageDir/kavupdater.sh";
+ $KavUpdateCommand = "cat $KavUpdateBinary | sed -e 's/==/=/g' | sh";
+ 
+-$LockFile = "/tmp/KasperskyBusy.lock";
++$LockFile = shift || "/var/spool/MailScanner/incoming/Locks/kasperskyBusy.lock";
+ 
+ $LOCK_SH = 1;
+ $LOCK_EX = 2;
+@@ -87,7 +87,6 @@
+ 
+ sub Unlock {
+ 	print LOCK "Unlocked after updating Kaspersky definitions by $$\n";
+-	unlink $LockFile;
+ 	flock(LOCK, $LOCK_UN);
+ 	close LOCK;
+ }
+diff -urNad mailscanner-4.68.8~/lib/kaspersky-wrapper mailscanner-4.68.8/lib/kaspersky-wrapper
+--- mailscanner-4.68.8~/lib/kaspersky-wrapper	2008-12-22 20:51:38.000000000 +0100
++++ mailscanner-4.68.8/lib/kaspersky-wrapper	2008-12-22 22:48:15.000000000 +0100
+@@ -41,7 +41,7 @@
+ # For KAV4FS 5.5
+ Scanner=kav4fs/bin/kav4fs-kavscanner
+ if [ -x ${PackageDir}/$Scanner ]; then
+-  Report=/tmp/kavoutput.tmp.$$
++  Report=`mktemp /tmp/kavoutput.tmp.XXXXXX` || exit 1
+   ScanOptions="-xp -i0" # Don't report progress, don't attempt to clean
+   if [ "x$1" = "x-IsItInstalled" ]; then
+     exit 0
+@@ -59,7 +59,7 @@
+ # For KAV 5.5.0
+ Scanner=kav4unix/bin/kavscanner
+ if [ -x ${PackageDir}/$Scanner ]; then
+-  Report=/tmp/kavoutput.tmp.$$
++  Report=`mktemp /tmp/kavoutput.tmp.XXXXXX` || exit 1
+   ScanOptions="-xp -i0" # Don't report progress, don't attempt to clean
+   if [ "x$1" = "x-IsItInstalled" ]; then
+     exit 0
+@@ -77,7 +77,7 @@
+ # For KAV 4.5.0
+ Scanner=bin/kavscanner
+ if [ -x ${PackageDir}/$Scanner ]; then
+-  Report=/tmp/kavoutput.tmp.$$
++  Report=`mktemp /tmp/kavoutput.tmp.XXXXXX` || exit 1
+   ScanOptions="-xp -i0" # Don't report progress, don't attempt to clean
+   if [ "x$1" = "x-IsItInstalled" ]; then
+     exit 0
+diff -urNad mailscanner-4.68.8~/lib/mcafee-autoupdate mailscanner-4.68.8/lib/mcafee-autoupdate
+--- mailscanner-4.68.8~/lib/mcafee-autoupdate	2008-12-22 20:51:38.000000000 +0100
++++ mailscanner-4.68.8/lib/mcafee-autoupdate	2008-12-22 22:48:15.000000000 +0100
+@@ -27,7 +27,7 @@
+ 
+ # handle the command line
+ usage () {
+-        echo "usage: $0 [-dfrtv] [-Rnnn] [-Innn] [proxy] [prefix]"
++        echo "usage: $0 [-dfrtv] [-Rnnn] [-Innn] [proxy] [prefix] [lock]"
+         echo "  -d      delete old files"
+         echo "  -e      get extra.dat"
+         echo "  -f      force update"
+@@ -38,10 +38,11 @@
+         echo "  -I      retry interval"
+         echo "  proxy   URL of FTP/HTTP proxy server"
+         echo "  prefix  uvscan installation directory"
++	echo "  lock    lockfile location"
+         exit 1
+ }
+ case $# in
+-[012345])
++[0123456])
+         : ok
+         ;;
+ *)      usage
+@@ -56,6 +57,8 @@
+                 ;;
+         -*)     OPTS=$arg
+                 ;;
++	lock*)	LOCKFILE=$arg
++		;;
+         /*)     PREFIX=$arg
+                 ;;
+         http:)  ftp_proxy=$arg
+diff -urNad mailscanner-4.68.8~/lib/nod32-autoupdate mailscanner-4.68.8/lib/nod32-autoupdate
+--- mailscanner-4.68.8~/lib/nod32-autoupdate	2008-12-22 20:51:38.000000000 +0100
++++ mailscanner-4.68.8/lib/nod32-autoupdate	2008-12-22 22:48:15.000000000 +0100
+@@ -5,7 +5,7 @@
+ $Nod32Root  = shift || "/usr/local/nod32";
+ 
+ $Nod32Auth  = "nod32.auth";
+-$LockFile = "/tmp/Nod32Busy.lock";
++$LockFile = shift || "/var/spool/MailScanner/incoming/Locks/nod32Busy.lock";
+ 
+ $LOCK_SH = 1;
+ $LOCK_EX = 2;
+@@ -66,7 +66,6 @@
+ 
+ sub Unlock {
+ 	print LOCK "Unlocked after updating virus definitions by $$\n";
+-	unlink $LockFile;
+ 	flock(LOCK, $LOCK_UN);
+ 	close LOCK;
+ }
+diff -urNad mailscanner-4.68.8~/lib/norman-autoupdate mailscanner-4.68.8/lib/norman-autoupdate
+--- mailscanner-4.68.8~/lib/norman-autoupdate	2008-12-22 20:51:38.000000000 +0100
++++ mailscanner-4.68.8/lib/norman-autoupdate	2008-12-22 22:48:15.000000000 +0100
+@@ -6,7 +6,7 @@
+ 
+ $UpdateCommand = "$PackageDir/niu";
+ 
+-$LockFile = "/tmp/NormanBusy.lock";
++$LockFile = shift || "/var/spool/MailScanner/incoming/Locks/normanBusy.lock";
+ 
+ $LOCK_SH = 1;
+ $LOCK_EX = 2;
+@@ -60,7 +60,6 @@
+ 
+ sub UnlockNorman {
+ 	print LOCK "Unlocked after updating Norman definitions by $$\n";
+-	unlink $LockFile;
+ 	flock(LOCK, $LOCK_UN);
+ 	close LOCK;
+ }
+diff -urNad mailscanner-4.68.8~/lib/panda-autoupdate mailscanner-4.68.8/lib/panda-autoupdate
+--- mailscanner-4.68.8~/lib/panda-autoupdate	2008-12-22 20:51:38.000000000 +0100
++++ mailscanner-4.68.8/lib/panda-autoupdate	2008-12-22 22:48:15.000000000 +0100
+@@ -31,7 +31,7 @@
+ 
+ DATE=`date +%m%d`
+ GETSTRING="http://updates.pandasoftware.com:8003/software/basevirus/pav$DATE.zip"
+-TEMPDIR="/tmp"
++TEMPDIR=`mktemp -d /tmp/panda.XXXXXX` || exit 1
+ STARTDIR=`pwd`
+ 
+ # Doing it.
+@@ -79,6 +79,9 @@
+ 
+ # All the action is over :) 
+ 
++cd /
++rm -rf $TEMPDIR
++
+ echo ""
+ echo "Update complete. Have a nice day!"
+ echo ""
+diff -urNad mailscanner-4.68.8~/lib/rav-autoupdate mailscanner-4.68.8/lib/rav-autoupdate
+--- mailscanner-4.68.8~/lib/rav-autoupdate	2008-12-22 20:51:38.000000000 +0100
++++ mailscanner-4.68.8/lib/rav-autoupdate	2008-12-22 22:48:15.000000000 +0100
+@@ -10,7 +10,7 @@
+ my($PackageDir, $retval);
+ $PackageDir = shift || "/usr/local/rav8";
+ my($TimeOut) = 5*60; # 5 minutes
+-my($LockFile)  = '/tmp/RavBusy.lock';
++my($LockFile)  = shift || '/var/spool/MailScanner/incoming/Locks/ravBusy.lock';
+ my($ravcommand) = "$PackageDir/bin/ravlin8";
+ my($ravupdate) = "$ravcommand --update=engine";
+ 
+@@ -77,7 +77,6 @@
+ 
+ sub UnlockRav {
+         print LOCK "Unlocked after updating Rav Antivirus engine files by $$\n";
+-	unlink $LockFile;
+         flock(LOCK, $LOCK_UN);
+         close LOCK;
+ }
+diff -urNad mailscanner-4.68.8~/lib/rav-wrapper mailscanner-4.68.8/lib/rav-wrapper
+--- mailscanner-4.68.8~/lib/rav-wrapper	2008-12-22 20:51:38.000000000 +0100
++++ mailscanner-4.68.8/lib/rav-wrapper	2008-12-22 23:00:09.000000000 +0100
+@@ -1,12 +1,14 @@
+ #!/usr/bin/perl -w
+ 
++use File::Temp qw{tempdir tempfile};
++
+ # specify complete path+name for RAV program
+ #my $ravprogram = '/usr/local/rav8/bin/ravlin8';
+ my $ravprogram;
+ $ravprogram = shift;
+ $ravprogram .= '/bin/ravav';
+ 
+-my $tmpdir = '/tmp';
++my $tmpdir = tempdir("/tmp/rav.XXXXXX", CLEANUP => 1);
+ 
+ if ($ARGV[0] eq '-IsItInstalled') {
+   exit 0 if -x $ravprogram;
+diff -urNad mailscanner-4.68.8~/lib/sophos-autoupdate mailscanner-4.68.8/lib/sophos-autoupdate
+--- mailscanner-4.68.8~/lib/sophos-autoupdate	2008-12-22 22:48:13.000000000 +0100
++++ mailscanner-4.68.8/lib/sophos-autoupdate	2008-12-22 22:48:15.000000000 +0100
+@@ -7,7 +7,7 @@
+ #
+ # Update V5 first, then V4
+ #
+-$LockFile = "/tmp/SophosBusy.lock";
++$LockFile = shift || "/var/spool/MailScanner/incoming/Locks/sophosBusy.lock";
+ 
+ $LOCK_SH = 1;
+ $LOCK_EX = 2;
+@@ -167,7 +167,6 @@
+ # Used for V4 and V5
+ sub UnlockSophos {
+ 	print LOCK "Unlocked after updating Sophos IDE files by $$\n";
+-	unlink $LockFile;
+ 	flock(LOCK, $LOCK_UN);
+ 	close LOCK;
+ }
+diff -urNad mailscanner-4.68.8~/lib/symscanengine-autoupdate mailscanner-4.68.8/lib/symscanengine-autoupdate
+--- mailscanner-4.68.8~/lib/symscanengine-autoupdate	2008-12-22 20:51:38.000000000 +0100
++++ mailscanner-4.68.8/lib/symscanengine-autoupdate	2008-12-22 22:48:15.000000000 +0100
+@@ -4,7 +4,7 @@
+  
+ $PackageDir = shift || "/opt/SYMCScan";
+  
+-$LockFile = "/tmp/SymScanEngineBusy.lock";
++$LockFile = shift || "/var/spool/MailScanner/incoming/Locks/symscanengineBusy.lock";
+  
+ $LOCK_SH = 1;
+ $LOCK_EX = 2;
+@@ -54,7 +54,6 @@
+  
+ sub UnlockSymantec {
+ 	print LOCK "Unlocked after updating SymScanEngine patterns by $$\n";
+-	unlink $LockFile;
+ 	flock(LOCK, $LOCK_UN);
+ 	close LOCK;
+ }
+diff -urNad mailscanner-4.68.8~/lib/trend-autoupdate mailscanner-4.68.8/lib/trend-autoupdate
+--- mailscanner-4.68.8~/lib/trend-autoupdate	2008-12-22 20:51:38.000000000 +0100
++++ mailscanner-4.68.8/lib/trend-autoupdate	2008-12-22 22:48:15.000000000 +0100
+@@ -3,6 +3,8 @@
+ # Trend Autoupdate Script.
+ # V0.1 Dan Bird. dbird@sghms.ac.uk
+ # 12/08/2003
++# V1.1 Julian Field. mailscanner@ecs.soton.ac.uk
++# 22/11/2008
+ 
+ # Make it work on new POSIX systems
+ export _POSIX2_VERSION=199209
+@@ -10,22 +12,29 @@
+ PackageDir=$1
+ export PackageDir
+ shift
++# Throw away lockfile
++shift
+ 
++TEMPDIR=`mktemp -d /tmp/trend-update.XXXXXX` || exit 1
+ OPRINI=opr.ini.$$
+ export OPRINI
+ 
++trap "rm -rf $TEMPDIR" EXIT
++
+ # source of IScan dat files
+ FTPSERV="ftp://ftp.antivirus.com/products/pattern/"
+ 
+ # Get the info on new version...
+ echo "Checking for latest DAT version..."
+-wget -q -O /tmp/$OPRINI $FTPSERV/opr.ini
++# In case it crept into existence
++rm -f $TEMPDIR/$OPRINI
++wget -q -O $TEMPDIR/$OPRINI $FTPSERV/opr.ini
+ #NEWVER=`grep PatternVersion /tmp/opr.ini.$$ | sed s/^PatternVersion=//g | cut -c 1-3`
+-NEWVER=`grep PatternVersionNPF /tmp/opr.ini.$$ | sed s/^PatternVersionNPF=//g | cut -c 3-5`
++NEWVER=`grep PatternVersionNPF $TEMPDIR/$OPRINI | sed s/^PatternVersionNPF=//g | cut -c 3-5`
+ 
+ # What's out current version?
+ # For 2006 onwards CURRENTVER=`ls $PackageDir/* | grep lpt | tail -1 |  cut -d. -f 2`
+-CURRENTVER=`ls -rt $PackageDir/* | grep lpt | tail -1 |  cut -d. -f 2`
++CURRENTVER=`ls -rt $PackageDir/*lpt* /etc/iscan/*lpt* | tail -1 |  cut -d. -f 2`
+ 
+ if [ "$CURRENTVER" = "" ]
+ then
+@@ -34,10 +43,11 @@
+ echo "Current version is : $CURRENTVER, new version is : $NEWVER"
+ 
+ fail () {
+-        trap EXIT
++        trap '' EXIT
+         echo "Test run failed -- removing bad Trend data files"
+         echo "$OUT"
+-        rm -rf $PackageDir/lpt*$NEWVER*
++        rm -f $PackageDir/lpt*$NEWVER*
++	rm -rf $TEMPDIR
+ 	logger -p mail.warn -t trend-autoupdate Trend: update failed
+         exit 1
+ }
+@@ -47,17 +57,19 @@
+ if [ $CURRENTVER -ne $NEWVER ]
+ then
+         echo "Getting new DAT version : $NEWVER"
+-        wget -q -P /tmp  $FTPSERV/lpt$NEWVER.zip
++	# In case it crept into existence
++	rm -f $TEMPDIR/lpt$NEWVER.zip
++        wget -q -P $TEMPDIR  $FTPSERV/lpt$NEWVER.zip
+         printf "Testing file for corruption...."
+ 
+-        DATCHECK=`unzip -o -t /tmp/lpt$NEWVER.zip | grep "No errors"`
++        DATCHECK=`unzip -o -t $TEMPDIR/lpt$NEWVER.zip | grep "No errors"`
+ 
+         if [ "$DATCHECK" != "" ]
+         then
+                 echo "OK"
+-                mv /tmp/lpt$NEWVER.zip /etc/iscan
++                mv $TEMPDIR/lpt$NEWVER.zip /etc/iscan
+                 printf "installing...."
+-                cd $PackageDir
++                cd /etc/iscan # $PackageDir
+                 unzip -q -o lpt$NEWVER.zip
+                 echo "DONE"
+         else
+@@ -65,8 +77,8 @@
+         fi
+ 
+ 
+-        CMD="$PackageDir/vscan -v 2>&1"
+-        OUT=`$CMD`
++        #CMD="$PackageDir/vscan -v 2>&1"
++        OUT=`$PackageDir/vscan -v 2>&1`
+         case "$OUT" in
+                 *"read pattern failed"* | \
+                 *"invalid pattern file"* | \
+@@ -77,10 +89,16 @@
+         fail
+         ;;
+         esac
+-        trap EXIT
++        trap '' EXIT
+ 	logger -p mail.info -t trend-autoupdate Trend: DAT files updated from $CURRENTVER to $NEWVER
+ else
+         echo "DAT files are upto date"
+ 	logger -p mail.info -t trend-autoupdate Trend: DAT files are up to date
+ fi
+-rm -f /tmp/lpt*.zip /tmp/$OPRINI $PackageDir/*.zip
++# In case our dir turned into a link on its own...
++rm -f $TEMPDIR >/dev/null 2>&1
++rm -rf $TEMPDIR
++rm -f  $PackageDir/*.zip
++rm -f  /etc/iscan/*.zip
++exit 0
++
diff -Naur mailscanner-4.68.8/debian/patches/debian/patches/CVE-2008-5313.dpatch mailscanner-4.68.8-1+lenny1-proposed/debian/patches/debian/patches/CVE-2008-5313.dpatch
--- mailscanner-4.68.8/debian/patches/debian/patches/CVE-2008-5313.dpatch	1970-01-01 01:00:00.000000000 +0100
+++ mailscanner-4.68.8-1+lenny1-proposed/debian/patches/debian/patches/CVE-2008-5313.dpatch	2008-12-24 23:27:43.000000000 +0100
@@ -0,0 +1,7 @@
+#! /bin/sh /usr/share/dpatch/dpatch-run
+## CVE-2008-5313.dpatch by Simon Walter <Simon Walter <simon.walter@hp-factory.de>>
+##
+## All lines beginning with `## DP:' are a description of the patch.
+## DP: No description.
+
+@DPATCH@
diff -Naur mailscanner-4.68.8/debian/rules mailscanner-4.68.8-1+lenny1-proposed/debian/rules
--- mailscanner-4.68.8/debian/rules	2008-12-24 23:29:01.000000000 +0100
+++ mailscanner-4.68.8-1+lenny1-proposed/debian/rules	2008-12-24 23:27:44.000000000 +0100
@@ -60,14 +60,6 @@
 	: # fix lockfile location in all autoupdate scripts
 	mkdir -p debian/tmp/autoupdate/
 	cp -a lib/*autoupdate* debian/tmp/autoupdate/
-	for i in debian/tmp/autoupdate/*-autoupdate; do \
-	  sed -e '/LockFile *=/s,/tmp,/var/lock/subsys/MailScanner,' $$i > $$i.new; \
-	  if cmp -s $$i $$i.new; then \
-	    rm -f $$i; \
-	  else \
-	    mv $$i.new $$i; \
-	  fi; \
-	done
 
 	: # fix virus.scanners.conf
 	sed -e 's,/opt/MailScanner/lib/,/etc/MailScanner/wrapper/,g' etc/virus.scanners.conf > debian/tmp/virus.scanners.conf

Information forwarded to debian-bugs-dist@lists.debian.org, Simon Walter <simon.walter@hp-factory.de>:
Bug#506353; Package mailscanner. (Thu, 25 Dec 2008 21:48:03 GMT) Full text and rfc822 format available.

Acknowledgement sent to Nico Golde <debian-release+ml@ngolde.de>:
Extra info received and forwarded to list. Copy sent to Simon Walter <simon.walter@hp-factory.de>. (Thu, 25 Dec 2008 21:48:03 GMT) Full text and rfc822 format available.

Message #54 received at 506353@bugs.debian.org (full text, mbox):

From: Nico Golde <debian-release+ml@ngolde.de>
To: Simon Walter <simon.walter@hp-factory.de>
Cc: Gabor FUNK <FUNK.Gabor@hunetkft.hu>, Thomas Viehmann <tv@beamnet.de>, 506353@bugs.debian.org, debian-release@lists.debian.org, Mark Purcell <msp@debian.org>, Raphael Geissert <atomo64@gmail.com>, mailscanner@ecs.soton.ac.uk, Noah Meyerhans <frodo@morgul.net>, team@security.debian.org
Subject: Re: Bug#506353: lenny removal requests
Date: Thu, 25 Dec 2008 22:38:45 +0100
[Message part 1 (text/plain, inline)]
Hi,
* Simon Walter <simon.walter@hp-factory.de> [2008-12-25 00:43]:
> "Gabor FUNK" <FUNK.Gabor@hunetkft.hu> writes:
[...] 
> Current state of this work is: It works (MailScanner starts and scans
> a simple textmail) but it's not well tested.  There still need to be
> done some testing with TNEF attachment, virus removal and some other
> cases.
> 
> I currently don't Know when I will have the time to do this.
> 
> I have attached the diff against 4.68.8 debian package.

I'm afraid this is too late, mailscanner has already been 
removed from lenny.

Cheers
Nico
-- 
Nico Golde - http://www.ngolde.de - nion@jabber.ccc.de - GPG: 0x73647CFF
For security reasons, all text in this mail is double-rot13 encrypted.
[Message part 2 (application/pgp-signature, inline)]

Information forwarded to debian-bugs-dist@lists.debian.org, Simon Walter <simon.walter@hp-factory.de>:
Bug#506353; Package mailscanner. (Thu, 25 Dec 2008 23:24:04 GMT) Full text and rfc822 format available.

Acknowledgement sent to Julian Field <MailScanner@ecs.soton.ac.uk>:
Extra info received and forwarded to list. Copy sent to Simon Walter <simon.walter@hp-factory.de>. (Thu, 25 Dec 2008 23:24:04 GMT) Full text and rfc822 format available.

Message #59 received at 506353@bugs.debian.org (full text, mbox):

From: Julian Field <MailScanner@ecs.soton.ac.uk>
To: Simon Walter <simon.walter@hp-factory.de>, Gabor FUNK <FUNK.Gabor@hunetkft.hu>, Thomas Viehmann <tv@beamnet.de>, 506353@bugs.debian.org, debian-release@lists.debian.org, Mark Purcell <msp@debian.org>, Raphael Geissert <atomo64@gmail.com>, Noah Meyerhans <frodo@morgul.net>, team@security.debian.org
Subject: Re: Bug#506353: lenny removal requests
Date: Thu, 25 Dec 2008 23:20:26 +0000

On 25/12/08 21:38, Nico Golde wrote:
> Hi,
> * Simon Walter<simon.walter@hp-factory.de>  [2008-12-25 00:43]:
>    
>> "Gabor FUNK"<FUNK.Gabor@hunetkft.hu>  writes:
>>      
> [...]
>    
>> Current state of this work is: It works (MailScanner starts and scans
>> a simple textmail) but it's not well tested.  There still need to be
>> done some testing with TNEF attachment, virus removal and some other
>> cases.
>>
>> I currently don't Know when I will have the time to do this.
>>
>> I have attached the diff against 4.68.8 debian package.
>>      
>
> I'm afraid this is too late, mailscanner has already been
> removed from lenny.
>    
Shame you couldn't wait 6 days for the new stable release. I don't 
immediately release a new stable release after making lots of changes to 
ensure it has received some testing in the field first. Your loss.

Jules

-- 
Julian Field MEng CITP CEng
www.MailScanner.info
Buy the MailScanner book at www.MailScanner.info/store

MailScanner customisation, or any advanced system administration help?
Contact me at Jules@Jules.FM

PGP footprint: EE81 D763 3DB0 0BFD E1DC 7222 11F6 5947 1415 B654
PGP public key: http://www.jules.fm/julesfm.asc


-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.





Information forwarded to debian-bugs-dist@lists.debian.org, Simon Walter <simon.walter@hp-factory.de>:
Bug#506353; Package mailscanner. (Fri, 26 Dec 2008 12:27:02 GMT) Full text and rfc822 format available.

Acknowledgement sent to Thijs Kinkhorst <thijs@debian.org>:
Extra info received and forwarded to list. Copy sent to Simon Walter <simon.walter@hp-factory.de>. (Fri, 26 Dec 2008 12:27:03 GMT) Full text and rfc822 format available.

Message #64 received at 506353@bugs.debian.org (full text, mbox):

From: Thijs Kinkhorst <thijs@debian.org>
To: Julian Field <MailScanner@ecs.soton.ac.uk>
Cc: 506353@bugs.debian.org
Subject: Re: Bug#506353: lenny removal requests
Date: Fri, 26 Dec 2008 13:23:29 +0100
[Message part 1 (text/plain, inline)]
On Friday 26 December 2008 00:20, Julian Field wrote:
> > I'm afraid this is too late, mailscanner has already been
> > removed from lenny.
>
> Shame you couldn't wait 6 days for the new stable release. I don't
> immediately release a new stable release after making lots of changes to
> ensure it has received some testing in the field first. Your loss.

This is indeed a pity. However, as a distribution with 20,000 packages, it's 
unavoidable that sometimes release schedules are not aligned and that from 
time to time, in some place a price needs to be paid to keep the larger plan 
rolling.


Thijs
[Message part 2 (application/pgp-signature, inline)]

Information forwarded to debian-bugs-dist@lists.debian.org, Simon Walter <simon.walter@hp-factory.de>:
Bug#506353; Package mailscanner. (Fri, 26 Dec 2008 19:36:13 GMT) Full text and rfc822 format available.

Acknowledgement sent to Marc 'HE' Brockschmidt <he@ftwca.de>:
Extra info received and forwarded to list. Copy sent to Simon Walter <simon.walter@hp-factory.de>. (Fri, 26 Dec 2008 19:36:13 GMT) Full text and rfc822 format available.

Message #69 received at 506353@bugs.debian.org (full text, mbox):

From: Marc 'HE' Brockschmidt <he@ftwca.de>
To: Julian Field <MailScanner@ecs.soton.ac.uk>
Cc: 506353@bugs.debian.org, debian-release@lists.debian.org,
Subject: Re: Bug#506353: lenny removal requests
Date: Fri, 26 Dec 2008 20:33:30 +0100
[Message part 1 (text/plain, inline)]
Julian Field <MailScanner@ecs.soton.ac.uk> writes:
> On 25/12/08 21:38, Nico Golde wrote:
>> I'm afraid this is too late, mailscanner has already been
>> removed from lenny.
> Shame you couldn't wait 6 days for the new stable release. I don't
> immediately release a new stable release after making lots of changes to
> ensure it has received some testing in the field first. Your loss.

It wouldn't have been included anyway. Making lots of changes is not
something the Debian elease team wants to see shortly before a release.

> -- 
> This message has been scanned for viruses and
> dangerous content by MailScanner, and is
> believed to be clean.

This signature is a bad idea.

Marc
-- 
Fachbegriffe der Informatik - Einfach erklärt
89: PSD
       Damit die Schriften nicht aussehen, als wären sie mit der
       Laubsäge bearbeitet. (Meikel Katzengreis)
[Message part 2 (application/pgp-signature, inline)]

Reply sent to Simon Walter <simon.walter@hp-factory.de>:
You have taken responsibility. (Fri, 30 Jan 2009 21:24:14 GMT) Full text and rfc822 format available.

Notification sent to Raphael Geissert <atomo64@gmail.com>:
Bug acknowledged by developer. (Fri, 30 Jan 2009 21:24:15 GMT) Full text and rfc822 format available.

Message #74 received at 506353-close@bugs.debian.org (full text, mbox):

From: Simon Walter <simon.walter@hp-factory.de>
To: 506353-close@bugs.debian.org
Subject: Bug#506353: fixed in mailscanner 4.74.16-1
Date: Fri, 30 Jan 2009 21:17:05 +0000
Source: mailscanner
Source-Version: 4.74.16-1

We believe that the bug you reported is fixed in the latest version of
mailscanner, which is due to be installed in the Debian FTP archive:

mailscanner_4.74.16-1.diff.gz
  to pool/main/m/mailscanner/mailscanner_4.74.16-1.diff.gz
mailscanner_4.74.16-1.dsc
  to pool/main/m/mailscanner/mailscanner_4.74.16-1.dsc
mailscanner_4.74.16-1_all.deb
  to pool/main/m/mailscanner/mailscanner_4.74.16-1_all.deb
mailscanner_4.74.16.orig.tar.gz
  to pool/main/m/mailscanner/mailscanner_4.74.16.orig.tar.gz



A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 506353@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Simon Walter <simon.walter@hp-factory.de> (supplier of updated mailscanner package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.8
Date: Tue, 20 Jan 2009 22:23:36 +0100
Source: mailscanner
Binary: mailscanner
Architecture: source all
Version: 4.74.16-1
Distribution: unstable
Urgency: low
Maintainer: Simon Walter <simon.walter@hp-factory.de>
Changed-By: Simon Walter <simon.walter@hp-factory.de>
Description: 
 mailscanner - email gateway for virus scanning, spam and phishing detection
Closes: 506353 512338
Changes: 
 mailscanner (4.74.16-1) unstable; urgency=low
 .
   * New upstream release (Closes: #506353)
     Fixes symlink vulnerability CVE-2008-5312, CVE-2008-5313, CVE-2008-5140
   * Added new description to install MailScanner with sendmail and queue aging
     README.sendmail.2 thanks to Jim Barber
   * Fixed patch for exim installation (Closes: #512338)
Checksums-Sha1: 
 0266df1dc8ff0ead4708e88f8c6dba3d0d3d67ef 1091 mailscanner_4.74.16-1.dsc
 e90c17c2e288561c9bad9416b8739fe1391648a9 745831 mailscanner_4.74.16.orig.tar.gz
 aaebcf31f413effd8fe49484a7499794a1751d11 41496 mailscanner_4.74.16-1.diff.gz
 2e6e56947a329eb6d5cb333a289d28b924edc498 681926 mailscanner_4.74.16-1_all.deb
Checksums-Sha256: 
 d6eecdc7d7c064439eae7426d118565a17b0ce3ad3096fec802c9baa9c7831ce 1091 mailscanner_4.74.16-1.dsc
 449f28784c8ee65d23748e1395872deb695f9065e7c27130ca594293374aa3e7 745831 mailscanner_4.74.16.orig.tar.gz
 12afe0d47df1143329fb82135d710aa62cb5bde04cd0f5c0eae7264de38a8f97 41496 mailscanner_4.74.16-1.diff.gz
 d1855f2cb0675f6162c88d8aeefb17d6fd3ac397ae67a723fa08f38d0dd9b3a3 681926 mailscanner_4.74.16-1_all.deb
Files: 
 95f1d6a1d1cda16628925630a810f382 1091 mail optional mailscanner_4.74.16-1.dsc
 889a8cb5b19d0b422649df882e441f2d 745831 mail optional mailscanner_4.74.16.orig.tar.gz
 5db472897688a4871b8b6d17ed96f7d3 41496 mail optional mailscanner_4.74.16-1.diff.gz
 6a340614b4ff3fe1f9141555bae65cc6 681926 mail optional mailscanner_4.74.16-1_all.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iEYEARECAAYFAkmDa+YACgkQ9/DnDzB9Vu0c0wCePCNd3sFhHEZgeMCaOqOPu5dU
UJoAoIis8fe2QmJke/JyEwvVliMZKc3+
=69kX
-----END PGP SIGNATURE-----





Bug archived. Request was from Debbugs Internal Request <owner@bugs.debian.org> to internal_control@bugs.debian.org. (Mon, 16 Mar 2009 09:13:05 GMT) Full text and rfc822 format available.

Send a report that this bug log contains spam.


Debian bug tracking system administrator <owner@bugs.debian.org>. Last modified: Sun Apr 20 09:33:58 2014; Machine Name: beach.debian.org

Debian Bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.