[dspam] [CVE-2007-6418] programming error leading to information disclosure

[disabled.user]

References:
DSA-1501-1 (http://www.debian.org/security/2008/dsa-1501)

Quoting:
"Tobias Gruetzmacher discovered that a Debian-provided CRON script in dspam,
a statistical spam filter, included a database password on the command line
when using the MySQL backend. This allowed a local attacker to read the
contents of the dspam database, such as emails."

[Daniel Hahler (blueyed)]

This is fixed in dspam 3.6.8-5.1, therefore Dapper, Edgy, Feisty and Gutsy are affected.

[Daniel Hahler (blueyed)]

The used patch has a regression, fixed in 3.6.8-7:
* libdspam7-drv-mysql: cron should use defaults-file. (Closes: #467437)

I'll redo the patches..

[Kees Cook (kees)]

These have been uploaded, thanks! They should be published shortly.