COMMAND
tnef
SYSTEMS AFFECTED
tnef < 0-124
PROBLEM
Tnef extracts eMails compressed with MS-Outlook. The compressed
file includes the path name to which the decompressed data should
be written.
By specifing a path name like /etc/passwd and sending a compressed
mail to root an adversary could gain remote root access to a
system by overwriting the local password database. The same could
happen if a mail virus scanner, like AMaVIS, process' a malicious
mail.
TNEF support was added to AMaViS 0.2.0-pre6-clm-rl-8-20000604
(previous versions are therefore *not* affected), but AMaViS does
not run as root when used with qmail, exim and postfix. AMaViS
is run as root, when used with sendmail and AMaViS is called via
Mlocal. AMaViS may not run as root, when used with sendmail and
the new relay scanning setup for AMaViS (--enable-relay).
SOLUTION
It's also possible to use the '-x' option of tnef to specify the
outputfile.
For SuSE Linux:
ftp://ftp.suse.com/pub/suse/axp/update/6.3/ap1/tnef-0-124.alpha.rpm
ftp://ftp.suse.com/pub/suse/axp/update/6.3/zq1/tnef-0-124.src.rpm
ftp://ftp.suse.com/pub/suse/axp/update/6.4/ap1/tnef-0-124.alpha.rpm
ftp://ftp.suse.com/pub/suse/axp/update/6.4/zq1/tnef-0-124.src.rpm
ftp://ftp.suse.com/pub/suse/i386/update/6.3/ap1/tnef-0-124.i386.rpm
ftp://ftp.suse.com/pub/suse/i386/update/6.3/zq1/tnef-0-124.src.rpm
ftp://ftp.suse.com/pub/suse/i386/update/6.4/ap1/tnef-0-124.i386.rpm
ftp://ftp.suse.com/pub/suse/i386/update/6.4/zq1/tnef-0-124.src.rpm
ftp://ftp.suse.com/pub/suse/ppc/update/6.3/ap1/tnef-0-124.ppc.rpm
ftp://ftp.suse.com/pub/suse/ppc/update/6.3/zq1/tnef-0-124.src.rpm
ftp://ftp.suse.com/pub/suse/ppc/update/6.4/ap1/tnef-0-124.ppc.rpm
ftp://ftp.suse.com/pub/suse/ppc/update/6.4/zq1/tnef-0-124.src.rpm
A fix for this possible security hole was provided in AMaViS
0.2.0-pre6-clm-rl-8-20000704. It's available at
http://sourceforge.net/projects/amavis
http://cvsweb.amavis.org/
http://www.computer-networking.de/~link/security/amavis-patch.php3#latest_sources
It is recommended to use Mark Simpson's TNEF which does not
suffer from this security problem, as it supportes the -d flag to
extract files to a specific directory.