Description
Extcompose in metamail does not verify the output file before writing to it, which allows local users to overwrite arbitrary files via a symlink attack.
References
- 20040312 Metamail 'extcompose' script Symlink Vulnerability mailing-list
- 9850 vdb-entry
- metamail-extcompose-symlink(15460) vdb-entry