CVE-2010-3292

MediumCVSS 5.5/10Last modified Jun 16, 2026

Description

The update{_bad,}_phishing_sites scripts in mailscanner 4.79.11-2 downloads files and trusts them without using encryption (e.g., https) or digital signature checking which could allow an attacker to replace certain configuration files (e.g., phishing whitelist) via dns/packet spoofing.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-311

Affected software

Vendor	Product	Versions
mailscanner	mailscanner	4.79.11-2

References

https://access.redhat.com/security/cve/cve-2010-3292Broken Link
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=596396Mailing List, Third Party Advisory
https://security-tracker.debian.org/tracker/CVE-2010-3292Third Party Advisory
https://www.openwall.com/lists/oss-security/2010/09/13/9Mailing List, Third Party Advisory
https://access.redhat.com/security/cve/cve-2010-3292Broken Link
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=596396Mailing List, Third Party Advisory
https://security-tracker.debian.org/tracker/CVE-2010-3292Third Party Advisory
https://www.openwall.com/lists/oss-security/2010/09/13/9Mailing List, Third Party Advisory

Timeline

Published: Nov 12, 2019
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2010

CVE-2010-32935.5mailscanner can allow local users to prevent virus signatures from being updated CVE-2010-32944.3Cross-site scripting (XSS) vulnerability in apc.php in the Alternative PHP Cache (APC) extension before 3.1.4 for PHP allows remote attacker CVE-2010-32962.1The cxgb_extension_ioctl function in drivers/net/cxgb3/cxgb3_main.c in the Linux kernel before 2.6.36-rc5 does not properly initialize a cer CVE-2010-32972.1The eql_g_master_cfg function in drivers/net/eql.c in the Linux kernel before 2.6.36-rc5 does not properly initialize a certain structure me CVE-2010-32982.1The hso_get_count function in drivers/net/usb/hso.c in the Linux kernel before 2.6.36-rc5 does not properly initialize a certain structure m CVE-2010-32996.5The encrypt/decrypt functions in Ruby on Rails 2.3 are vulnerable to padding oracle attacks.CVE-2010-33005.9It was found that all OWASP ESAPI for Java up to version 2.0 RC2 are vulnerable to padding oracle attacks.CVE-2010-33017.2The IA32 system call emulation functionality in arch/x86/ia32/ia32entry.S in the Linux kernel before 2.6.36-rc4-git2 on the x86_64 platform CVE-2010-33026.5Buffer overflow in programs/pluto/xauth.c in the client in Openswan 2.6.25 through 2.6.28 might allow remote authenticated gateways to execu CVE-2010-33033.5Multiple cross-site scripting (XSS) vulnerabilities in MantisBT before 1.2.3 allow remote authenticated administrators to inject arbitrary w CVE-2010-33046.4The ACL plugin in Dovecot 1.2.x before 1.2.13 propagates INBOX ACLs to newly created mailboxes in certain configurations, which might allow CVE-2010-33058.8Cross-site request forgery (CSRF) vulnerability in pixelpost 1.7.3 could allow remote attackers to change the admin password.