Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Loading...
Explore Latest Linux Security advisories
We found -5 articles for you...
91
security advisorygentooremote attackGentoo: GLSA-202301-14 Normal: Fetchmail Security Flaw Exposed
Multiple vulnerabilities have been discovered in getmail, allowing remote attackers to obtain sensitive information.. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201412-50 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: getmail: Information disclosure Date: December 28, 2014 Bugs: #524684 ID: 201412-50 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======= Multiple vulnerabilities have been discovered in getmail, allowing remote attackers to obtain sensitive information. Background ========= getmail is a POP3 mail retriever with reliable Maildir and mbox delivery. Affected packages ================ ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 net-mail/getmail < 4.46.0 > = 4.46.0 Description ========== Multiple vulnerabilities have been discovered in getmail. Please review the CVE identifiers referenced below for details. Impact ===== A remote attacker could cause a man-in-the-middle attack via multiple vectors to obtain sensitive information. Workaround ========= There is no known workaround at this time. Resolution ========= All getmail users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose "> =net-mail/getmail-4.46.0" References ========= [ 1 ] CVE-2014-7273 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-7273 [ 2 ] CVE-2014-7274 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-7274 [ 3 ] CVE-2014-7275 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-7275 Availability =========== This GLSA and any updates to itare available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/201412-50 Concerns? ======== Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to
Dec 28, 2014
Gentoo
99
security advisorymoderateslackwareSlackware 10.0: SSA:2004-278-01 Moderate: Getmail Local Exploit Risk
New getmail packages are available for Slackware 9.1, 10.0 and -current to fix a security issue. If getmail is used as root to deliver to user owned files or directories, it can be made to overwrite system files. More details about this issue may be found in the Common . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 [slackware-security] getmail (SSA:2004-278-01) New getmail packages are available for Slackware 9.1, 10.0 and -current to fix a security issue. If getmail is used as root to deliver to user owned files or directories, it can be made to overwrite system files. More details about this issue may be found in the Common Vulnerabilities and Exposures (CVE) database: https://www.cve.org/CVERecord?id=CAN-2004-880 https://www.cve.org/CVERecord?id=CAN-2004-881 Here are the details from the Slackware 10.0 ChangeLog: +--------------------------+ patches/packages/getmail-4.2.0-noarch-1.tgz: Upgraded to getmaii-4.2.0. Earlier versions contained a local security flaw when used in an insecure fashion (surprise, running something as root that writes to user-controlled files or directories could allow the old symlink attack to clobber system files! :-) From the getmail CHANGELOG: This vulnerability is not exploitable if the administrator does not deliver mail to the maildirs/mbox files of untrusted local users, or if getmail is configured to use an external unprivileged MDA. This vulnerability is not remotely exploitable. Most users would not use getmail in such as way as to be vulnerable to this flaw, but if your site does this package closes the hole. I'd also recommend not using getmail like this. Either run it as the user that owns the target mailbox, or deliver through an external MDA. (* Security fix *) +--------------------------+ Where to find the new packages: +-----------------------------+ Updated package for Slackware 9.1: ftp://ftp.slackware.com/pub/slackware/slackware-9.1/patches/packages/getmail-3.2.5-noarch-1.tgz Updated package forSlackware 10.0: ftp://ftp.slackware.com/pub/slackware/slackware-10.0/patches/packages/getmail-4.2.0-noarch-1.tgz Updated package for Slackware -current: MD5 signatures: +-------------+ Slackware 9.1 package: d31d3b88d33488fc55061ea154e31457 getmail-3.2.5-noarch-1.tgz Slackware 10.0 package: 47b5454e061919f2d2128a16fca3a037 getmail-4.2.0-noarch-1.tgz Slackware -current package: 65f55bffa3f5fb5158f5f5efb590671a getmail-4.2.0-noarch-1.tgz Installation instructions: +------------------------+ Upgrade the package as root: # upgradepkg getmail-4.2.0-noarch-1.tgz +-----+ . Recent getmail updates for Slackware tackle important vulnerabilities such as unauthorized file modifications – vital for ensuring system integrity.. Slackware, Getmail Update, Security Package, Attack Prevention. . LinuxSecurity.com Team
Oct 04, 2004
Slackware
87
security advisorycriticaldebianDebian: DSA 553-1 Critical: Getmail Symlink Issue Exploit
A security problem has been discovered in getmail, a POP3 and APOP mail gatherer and forwarder. An attacker with a shell account on the victims host could utilise getmail to overwrite arbitrary files when it is running as root.. -------------------------------------------------------------------------- Debian Security Advisory DSA 553-1
Sep 27, 2004
•Critical
Debian
91
security advisoryGentoogetmailGentoo Linux 200409-32 High Risk: getmail Filesystem Overwrite
getmail contains a vulnerability that could potentially allow any local user to create or overwrite files in any directory on the system. This flaw can be escalated further and possibly lead to a complete system compromise. [More...]. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200409-32 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: High Title: getmail: Filesystem overwrite vulnerability Date: September 23, 2004 Bugs: #64643 ID: 200409-32 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======= getmail contains a vulnerability that could potentially allow any local user to create or overwrite files in any directory on the system. This flaw can be escalated further and possibly lead to a complete system compromise. Background ========= getmail is a reliable fetchmail replacement that supports Maildir, Mboxrd and external MDA delivery. Affected packages ================ ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 net-mail/getmail < 4.2.0 > = 4.2.0 Description ========== David Watson discovered a vulnerability in getmail when it is configured to run as root and deliver mail to the maildirs/mbox files of untrusted local users. A malicious local user can then exploit a race condition, or a similar symlink attack, and potentially cause getmail to create or overwrite files in any directory on the system. Impact ===== An untrusted local user could potentially create or overwrite files in any directory on the system. This vulnerability may also be exploited to have arbitrary commandsexecuted as root. Workaround ========= Do not run getmail as a privileged user; or, in version 4, use an external MDA with explicitly configured user and group privileges. Resolution ========= All getmail users should upgrade to the latest version: # emerge sync # emerge -pv "> =net-mail/getmail-4.2.0" # emerge "> =net-mail/getmail-4.2.0" References ========= [ 1 ] getmail ChangeLog [ 2 ] getmail Mailing List Availability =========== This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/200409-32 Concerns? ======== Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to
Sep 23, 2004
Gentoo
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!