Executive brief
MajorCool is a web-based interface for managing Majordomo mailing lists. A vulnerability in its caching component allows a local user on the same server to trick the application into modifying files they should not have access to. This could lead to unauthorized data modification or system instability if critical configuration files are targeted.
Technical details
The vulnerability is a symlink race condition within the mj_key_cache utility of MajorCool. Because the application does not securely handle temporary files or cache entries, a local attacker can create a symbolic link pointing to a sensitive file (such as a system configuration file) that the application has permissions to write to. When mj_key_cache attempts to write to its expected path, it follows the symlink and overwrites the target file instead. This requires local shell access to the server where MajorCool is hosted.
Affected products
- MajorCool MajorCool
Timeline
- 1997-06-18: disclosed: Initial NVD publication date