oss-security - Re: CVE id request: maildrop

Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Thu, 28 Jan 2010 08:42:36 -0500 (EST)
From: Josh Bressers <bressers@...hat.com>
To: oss-security@...ts.openwall.com
Subject: Re: CVE id request: maildrop

----- "Steffen Joeris" <steffen.joeris@...lelinux.de> wrote:
> 
> Christoph Anton Mitterer discovered that maildrop, a mail delivery agent
> with filtering abilities, is prone to a privilege escalation issue that
> grants a user root group privileges.
> 
> 
> The issue occurs when invoking maildrop -d, which keeps the root group
> privileges on the mailbox rather than changing them to the users gid.

> [0]: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=564601

Use CVE-2010-0301.

Thanks.

-- 
    JB

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.