| |||||||||||||
Keeping current with SpamAssassin rulesKeeping current with SpamAssassin rulesPosted Dec 7, 2006 12:16 UTC (Thu) by NAR (subscriber, #1313)Parent article: Keeping current with SpamAssassin rules More worrisome, however, is the fact that the update mechanism allows for plugins to be distributed, leading to potential arbitrary code execution. I guess it's true for all kind automated updating of software from non-trustworthy places, not just SA plugins written in perl. I mean if I'd have an "apt-get update; apt-get upgrade -y" from cron and one of the sites listed in the sources.list file is compromised, I could have a similar problem, a trojan sshd or something like that.
(Log in to post comments)
Keeping current with SpamAssassin rules Posted Dec 8, 2006 12:11 UTC (Fri) by nix (subscriber, #2304) [Link] Indeed, but people seem to have the assumption that spam scanners are 'sort of like virus scanners' and so can be updated safely. Because of the existence of plugins and eval rules (which are moved into plugins in 3.2.x), this is not true, but I can see why people might think it is.
|
|||||||||||||