Race condition in the safe_open function in the Mutt mail client 1.5.12 and earlier, when creating temporary files in an NFS filesystem, allows local users to overwrite arbitrary files due to limitations of the use of the O_EXCL flag on NFS filesystems.

The Rocky Linux 8.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_0112 advisory.

    This advisory aggregates security fixes for the mutt SRPM in CIQ LTS 8.6. It addresses 8 CVEs:
    CVE-2022-1328, CVE-2007-2683, CVE-2014-9116, CVE-2009-1390, CVE-2007-1558, and 3 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 5 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2007-0386 advisory.

    [5:1.4.1-12.0.3.el4]
     - fix overflow in gecos field handling (#240176, CVE-2007-2683)

     [5:1.4.1-12.0.2.el4]
     - buildrequire aspell

     [5:1.4.1-12.0.1.el4]
     - validate msgid in APOP authentication (#241201, CVE-2007-1558)
     - fix insecure temp file creation on NFS (#211085, CVE-2006-5297)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

A flaw was found in the way Mutt used temporary files on NFS file systems. Due to an implementation issue in the NFS protocol, Mutt was not able to exclusively open a new file. A local attacker could conduct a time-dependent attack and possibly gain access to e-mail attachments opened by a victim. (CVE-2006-5297)

A flaw was found in the way Mutt processed certain APOP authentication requests. By sending certain responses when mutt attempted to authenticate against an APOP server, a remote attacker could potentially acquire certain portions of a user's authentication credentials. (CVE-2007-1558)

A flaw was found in the way Mutt handled certain characters in gecos fields which could lead to a buffer overflow. The gecos field is an entry in the password database typically used to record general information about the user. A local attacker could give themselves a carefully crafted 'Real Name' which could execute arbitrary code if a victim uses Mutt and expands the attackers alias. (CVE-2007-2683)

Race conditions were discovered in mutt's handling of temporary files.
Under certain conditions when using a shared temp directory (the default), other local users could overwrite arbitrary files owned by the user running mutt. This vulnerability is more likely when the temp directory is over NFS.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An updated mutt package that fixes several security bugs is now available for Red Hat Enterprise Linux 3, 4 and 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

Mutt is a text-mode mail user agent.

A flaw was found in the way Mutt used temporary files on NFS file systems. Due to an implementation issue in the NFS protocol, Mutt was not able to exclusively open a new file. A local attacker could conduct a time-dependent attack and possibly gain access to e-mail attachments opened by a victim. (CVE-2006-5297)

A flaw was found in the way Mutt processed certain APOP authentication requests. By sending certain responses when mutt attempted to authenticate against an APOP server, a remote attacker could potentially acquire certain portions of a user's authentication credentials. (CVE-2007-1558)

A flaw was found in the way Mutt handled certain characters in gecos fields which could lead to a buffer overflow. The gecos field is an entry in the password database typically used to record general information about the user. A local attacker could give themselves a carefully crafted 'Real Name' which could execute arbitrary code if a victim uses Mutt and expands the attackers alias. (CVE-2007-2683)

All users of mutt should upgrade to this updated package, which contains a backported patches to correct these issues.

A race condition in the safe_open function in the Mutt mail client 1.5.12 and earlier, when creating temporary files in an NFS filesystem, allows local users to overwrite arbitrary files due to limitations of the use of the O_EXCL flag on NFS filesystems.
(CVE-2006-5297)

The mutt_adv_mktemp function in the Mutt mail client 1.5.12 and earlier does not properly verify that temporary files have been created with restricted permissions, which might allow local users to create files with weak permissions via a race condition between the mktemp and safe_fopen function calls. (CVE-2006-5298)

Updated packages have been patched to correct these issues.

ID	Name	Product	Family	Type	Severity
355913	Rocky Linux 8.6 [CIQ] Security Update: mutt / mutt-debuginfo / mutt-debugsource Multiple Vulnerabilities (ciqsa-2026_0112)	Nessus	Rocky Linux Local Security Checks	Local	medium
67505	Oracle Linux 5 : Moderate: / mutt (ELSA-2007-0386)	Nessus	Oracle Linux Local Security Checks	Local	high
60195	Scientific Linux Security Update : mutt on SL5.x, SL4.x, SL3.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	Local	low
27954	Ubuntu 5.10 / 6.06 LTS / 6.10 : mutt vulnerabilities (USN-373-1)	Nessus	Ubuntu Local Security Checks	Local	low
25404	RHEL 3 / 4 / 5 : mutt (RHSA-2007:0386)	Nessus	Red Hat Local Security Checks	Local	low
25403	CentOS 3 / 4 / 5 : mutt (CESA-2007:0386)	Nessus	CentOS Local Security Checks	Local	low
24575	Mandrake Linux Security Advisory : mutt (MDKSA-2006:190)	Nessus	Mandriva Local Security Checks	Local	low

Detections

Analytics

CVE-2006-5297

critical

Tenable Plugins

medium

high

low

low

low

low

low