FreeBSD : ifmail -- unsafe set-user-ID application (746ca1ac-21ec-11d9-9289-000c41e2cdad)

Niels Heinen reports that ifmail allows one to specify a configuration file. Since ifmail runs set-user-ID news', this may allow a local attacker to write to arbitrary files or execute arbitrary commands as the news' user. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text...