N/A - GLSA-201904-22

Executive Summary

Summary
Title	OpenDKIM: Root privilege escalation

Informations
Name	GLSA-201904-22	First vendor Publication	2019-04-22
Vendor	Gentoo	Last vendor Modification	2019-04-22
Severity (Vendor)	N/A	Revision	N/A

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score	NA
Base Score	NA	Environmental Score	NA
impact SubScore	NA	Temporal Score	NA
Exploitabality Sub Score	NA

Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector :
Cvss Base Score	N/A	Attack Range	N/A
Cvss Impact Score	N/A	Attack Complexity	N/A
Cvss Expoit Score	N/A	Authentication	N/A
Calculate full CVSS 2.0 Vectors scores

Detail

Synopsis

A vulnerability was discovered in Gentoo's ebuild for OpenDKIM which could lead to root privilege escalation.

Background

A community effort to develop and maintain a C library for producing DKIM-aware applications and an open source milter for providing DKIM service.

Description

It was discovered that Gentoo’s OpenDKIM ebuild does not properly set permissions or place the pid file in a safe directory.

Impact

A local attacker could escalate privileges.

Workaround

Users should ensure the proper permissions are set as discussed in the referenced bugs.

Resolution

All OpenDKIM users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=mail-filter/opendkim-2.10.3-r8"

References

Availability

This GLSA and any updates to it are available for viewing at the Gentoo Security Website:

https://security.gentoo.org/glsa/201904-22