A security issue has been reported in Sympa, which can be exploited by malicious, local users to perform actions with escalated privileges.

The security issue is caused due to the sympa.pl script creating files in an insecure manner. This can be exploited via symlink attacks to modify arbitrary files with the privileges of the user running the affected script with the "--make_alias_file" option.

The security issue is reported version 5.4.3. Other versions may also be affected.

Solution
Fixed in the CVS repository.

Provided and/or discovered by
Olivier Berger

Changelog
Further details available in Customer Area

Original Advisory
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=494969

Deep Links
Links available in Customer Area