main.C in maildrop 2.3.0 and earlier, when run by root with the -d option, uses the gid of root for execution of the .mailfilter file in a user's home directory, which allows local users to gain privileges via a crafted file.

The remote host is affected by the vulnerability described in GLSA-201009-02 (Maildrop: privilege escalation)

    Christoph Anton Mitterer reported that maildrop does not properly drop     its privileges when run as root.
  Impact :

    A local attacker could create a specially crafted .mailfilter file,     possibly leading to the execution of arbitrary commands with the 'root'     group privileges. NOTE: Successful exploitation requires that maildrop     is run as root with the -d option.
  Workaround :

    There is no known workaround at this time.

This update brings maildrop to the latest upstream version closing CVE-2010-0301.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Christoph Anton Mitterer discovered that maildrop, a mail delivery agent with filtering abilities, is prone to a privilege escalation issue that grants a user root group privileges.

ID	Name	Product	Family	Severity
49115	GLSA-201009-02 : Maildrop: privilege escalation	Nessus	Gentoo Local Security Checks	medium
47284	Fedora 11 : maildrop-2.4.0-12.fc11 (2010-1927)	Nessus	Fedora Local Security Checks	medium
47279	Fedora 12 : maildrop-2.4.0-12.fc12 (2010-1863)	Nessus	Fedora Local Security Checks	medium
44845	Debian DSA-1981-1 : maildrop - privilege escalation	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2010-0301

high

Tenable Plugins

medium

medium

medium

medium