CVE-2010-3292: Medium severity mailscanner vulnerability
The update{bad,}phishingsites scripts in mailscanner 4.79.11-2 downloads files and trusts them without using encryption (e.g., https) or digital signature checking which could allow an attacker to replace certain configuration files (e.g., phishing whitelist) via dns/packet spoofing.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2010-3292?
CVE-2010-3292 is classified as a medium-severity vulnerability due to its potential for exploitation via DNS or packet spoofing.
How do I fix CVE-2010-3292?
To fix CVE-2010-3292, update to a later version of MailScanner that includes proper validation for downloaded files.
What systems are affected by CVE-2010-3292?
CVE-2010-3292 specifically affects MailScanner version 4.79.11-2.
What attack vector is associated with CVE-2010-3292?
CVE-2010-3292 can be exploited through DNS spoofing or packet manipulation to replace configuration files.
What files can be compromised due to CVE-2010-3292?
CVE-2010-3292 allows attackers to potentially replace certain configuration files, such as the phishing whitelist.