Executive Summary
| Summary | |
|---|---|
| Title | mutt vulnerabilities |
| Informations | |||
|---|---|---|---|
| Name | USN-373-1 | First vendor Publication | 2006-11-01 |
| Vendor | Ubuntu | Last vendor Modification | 2006-11-01 |
| Severity (Vendor) | N/A | Revision | N/A |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:L/AC:H/Au:N/C:N/I:P/A:N) | |||
|---|---|---|---|
| Cvss Base Score | 1.2 | Attack Range | Local |
| Cvss Impact Score | 2.9 | Attack Complexity | High |
| Cvss Expoit Score | 1.9 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| A security issue affects the following Ubuntu releases: Ubuntu 5.10 Ubuntu 6.06 LTS Ubuntu 6.10 This advisory also applies to the corresponding versions of Kubuntu, Edubuntu, and Xubuntu. The problem can be corrected by upgrading your system to the following package versions: Ubuntu 5.10: Ubuntu 6.06 LTS: Ubuntu 6.10: After a standard system upgrade you need to restart mutt to effect the necessary changes. Details follow: Race conditions were discovered in mutt's handling of temporary files. Under certain conditions when using a shared temp directory (the default), other local users could overwrite arbitrary files owned by the user running mutt. This vulnerability is more likely when the temp directory is over NFS. |
Original Source
| Url : http://www.ubuntu.com/usn/USN-373-1 |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:10601 | |||
| Oval ID: | oval:org.mitre.oval:def:10601 | ||
| Title: | Race condition in the safe_open function in the Mutt mail client 1.5.12 and earlier, when creating temporary files in an NFS filesystem, allows local users to overwrite arbitrary files due to limitations of the use of the O_EXCL flag on NFS filesystems. | ||
| Description: | Race condition in the safe_open function in the Mutt mail client 1.5.12 and earlier, when creating temporary files in an NFS filesystem, allows local users to overwrite arbitrary files due to limitations of the use of the O_EXCL flag on NFS filesystems. | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2006-5297 | Version: | 5 |
| Platform(s): | Red Hat Enterprise Linux 3 CentOS Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5 | Product(s): | |
| Definition Synopsis: | |||
| |||
CPE : Common Platform Enumeration
OpenVAS Exploits
| Date | Description |
|---|---|
| 2009-02-27 | Name : Fedora Update for mutt FEDORA-2007-540 File : nvt/gb_fedora_2007_540_mutt_fc5.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 30095 | Mutt mutt_adv_mktemp Function Race Condition Temporary File Permission Weakness |
| 30094 | Mutt safe_open Function NFS Filesystem Race Condition Arbitrary File Overwrite |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2013-07-12 | Name : The remote Oracle Linux host is missing a security update. File : oraclelinux_ELSA-2007-0386.nasl - Type : ACT_GATHER_INFO |
| 2012-08-01 | Name : The remote Scientific Linux host is missing a security update. File : sl_20070604_mutt_on_SL5_x.nasl - Type : ACT_GATHER_INFO |
| 2007-11-10 | Name : The remote Ubuntu host is missing a security-related patch. File : ubuntu_USN-373-1.nasl - Type : ACT_GATHER_INFO |
| 2007-06-04 | Name : The remote CentOS host is missing a security update. File : centos_RHSA-2007-0386.nasl - Type : ACT_GATHER_INFO |
| 2007-06-04 | Name : The remote Red Hat host is missing a security update. File : redhat-RHSA-2007-0386.nasl - Type : ACT_GATHER_INFO |
| 2007-02-18 | Name : The remote Mandrake Linux host is missing one or more security updates. File : mandrake_MDKSA-2006-190.nasl - Type : ACT_GATHER_INFO |
| 2007-01-17 | Name : The remote Fedora Core host is missing a security update. File : fedora_2006-1061.nasl - Type : ACT_GATHER_INFO |
| 2007-01-17 | Name : The remote Fedora Core host is missing a security update. File : fedora_2006-1063.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2014-02-17 12:03:54 |
|
