nullmailer world readable /etc/nullmailer/remotes

2013.08.10
Credit: Agostino Sarubbo
Risk: Low
Local: Yes
Remote: No
CVE: CVE-2013-4223
CWE: CWE-264


CVSS Base Score: 5/10
Impact Subscore: 2.9/10
Exploitability Subscore: 10/10
Exploit range: Remote
Attack complexity: Low
Authentication: No required
Confidentiality impact: Partial
Integrity impact: None
Availability impact: None

On Gentoo, the file /etc/nullmailer/remotes is installed with wrong permissions: ~ # ls -la /etc/nullmailer/remotes -rw-r--r-- 1 root root 971 Aug 9 18:58 /etc/nullmailer/remotes Nullmailer-1.11-r2 contains the fix, all prior versions are affected. Please assign a CVE. -- Agostino Sarubbo Gentoo Linux Developer

References:

http://seclists.org/oss-sec/2013/q3/339


See this note in RAW Version
Vote for this issue:
50%
50%

Comment it here.
Copyright 2025, cxsecurity.com

 

Back to Top