Re: [cobalt-users] Cobalt Security Advisory - 07.24.2000 - Qpopper

["Frank Cubillos" <cubillos@xxxxxxxxxxxxxxxxxx>]

Has anyone installed it on the RaQ3i yet? I have downloaded it but want to
hear feedback before I put it on our production server.
TIA
Frank

> --------------------------------------------------
> SNIP>
> --------------------------------------------------
> Qpopper 2.53 and older may permit an attacker who has
> access to a valid account to obtain a shell with group-id
> 'mail', potentially allowing read/write access to all mail.
> The Cobalt Qube2 was updated in with the latest
> version of qpopper as of OS Update 3.0.  If you
> have not installed that update yet, it is recommended
> you do so as soon as possible.  It can be found
> at:
> ftp://ftp.cobalt.com/pub/packages/qube2/eng/Qube2-Update-OS-2.0.pkg
> --------------------------------------------------
> Location:
>
> RaQ3
>
ftp://ftp.cobaltnet.com/pub/experimental/security/qpopper/RaQ3-Qpopper-3.0.2
.pkg
> RaQ2
>
ftp://ftp.cobaltnet.com/pub/experimental/security/qpopper/RaQ2-Qpopper-3.0.2
.pkg
> RaQ1
>
ftp://ftp.cobaltnet.com/pub/experimental/security/qpopper/RaQ1-Qpopper-3.0.2
.pkg
> Qube1
>
ftp://ftp.cobaltnet.com/pub/experimental/security/qpopper/Qube1-Qpopper-3.0.
2.pkg