We recommend setting the value to a protected directory belonging to the user. These modifications should reflect and reinforce the suggestions outlined in the previous two items, namely that the temporary directory metamail uses should be protected and accessible only by the user. Note that the following code fragments are for example only, and sites should adapt this code according to local requirements. Appendix A - Vendor Information Below is a list of the vendors who have provided information for this advisory. We will update this appendix as we receive additional information.
Patches are in progress.
Our metamail scripts are Bourne shell scripts from the SVR4.2MP distribution and do not have the parameter quoting problem. All rights reserved. Inc. If you installed the metamail package or port then you are vulnerable. All released versions of FreeBSD including 2.2.2R have this flaw in them. The port was corrected as of May 21, 1997.