Vulnerability Details : CVE-2010-0301
main.C in maildrop 2.3.0 and earlier, when run by root with the -d option, uses the gid of root for execution of the .mailfilter file in a user's home directory, which allows local users to gain privileges via a crafted file.
Exploit prediction scoring system (EPSS) score for CVE-2010-0301
Probability of exploitation activity in the next 30 days: 0.04%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 6 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2010-0301
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
|---|---|---|---|---|---|
|
6.9
|
MEDIUM | AV:L/AC:M/Au:N/C:C/I:C/A:C |
3.4
|
10.0
|
NIST |
CWE ids for CVE-2010-0301
-
Assigned by: nvd@nist.gov (Primary)
References for CVE-2010-0301
-
http://marc.info/?l=oss-security&m=126462927918840&w=2
'[oss-security] CVE id request: maildrop' - MARC
-
http://marc.info/?l=oss-security&m=126468324913920&w=2
'Re: [oss-security] CVE id request: maildrop' - MARC
-
http://www.courier-mta.org/maildrop/changelog.html
404 Not Found
-
https://bugzilla.redhat.com/show_bug.cgi?id=559681
559681 – (CVE-2010-0301) CVE-2010-0301 maildrop: does not drop supplimentary groups when dropping privileges
-
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=564601
#564601 - possible problems when switching UID/GIDs in delivery mode when run as root - Debian Bug report logs
-
http://securitytracker.com/id?1023515
Maildrop Lets Local Users Gain Elevated Group Privileges - SecurityTracker
-
http://marc.info/?l=oss-security&m=126468551017070&w=2
'Re: [oss-security] CVE id request: maildrop' - MARC
-
http://www.debian.org/security/2010/dsa-1981
Debian -- Security Information -- DSA-1981-1 maildrop
-
https://exchange.xforce.ibmcloud.com/vulnerabilities/55980
maildrop group privilege escalation CVE-2010-0301 Vulnerability Report
-
http://marc.info/?l=oss-security&m=126468618017829&w=2
'Re: [oss-security] CVE id request: maildrop' - MARC
Products affected by CVE-2010-0301
- cpe:2.3:a:maildrop:maildrop:*:*:*:*:*:*:*:*
- cpe:2.3:a:maildrop:maildrop:0.50:*:*:*:*:*:*:*
- cpe:2.3:a:maildrop:maildrop:0.54a:*:*:*:*:*:*:*
- cpe:2.3:a:maildrop:maildrop:0.55:*:*:*:*:*:*:*
- cpe:2.3:a:maildrop:maildrop:0.63:*:*:*:*:*:*:*
- cpe:2.3:a:maildrop:maildrop:0.65:*:*:*:*:*:*:*
- cpe:2.3:a:maildrop:maildrop:0.76:*:*:*:*:*:*:*
- cpe:2.3:a:maildrop:maildrop:0.99.2:*:*:*:*:*:*:*
- cpe:2.3:a:maildrop:maildrop:1.2.2:*:*:*:*:*:*:*
- cpe:2.3:a:maildrop:maildrop:1.3.1:*:*:*:*:*:*:*
- cpe:2.3:a:maildrop:maildrop:1.3.9:*:*:*:*:*:*:*
- cpe:2.3:a:maildrop:maildrop:0.55b:*:*:*:*:*:*:*
- cpe:2.3:a:maildrop:maildrop:0.55c:*:*:*:*:*:*:*
- cpe:2.3:a:maildrop:maildrop:0.60:*:*:*:*:*:*:*
- cpe:2.3:a:maildrop:maildrop:0.61:*:*:*:*:*:*:*
- cpe:2.3:a:maildrop:maildrop:1.0:*:*:*:*:*:*:*
- cpe:2.3:a:maildrop:maildrop:1.1:*:*:*:*:*:*:*
- cpe:2.3:a:maildrop:maildrop:1.2:*:*:*:*:*:*:*
- cpe:2.3:a:maildrop:maildrop:1.2.1:*:*:*:*:*:*:*
- cpe:2.3:a:maildrop:maildrop:1.5.1:*:*:*:*:*:*:*
- cpe:2.3:a:maildrop:maildrop:1.5.2:*:*:*:*:*:*:*
- cpe:2.3:a:maildrop:maildrop:0.51:*:*:*:*:*:*:*
- cpe:2.3:a:maildrop:maildrop:0.51b:*:*:*:*:*:*:*
- cpe:2.3:a:maildrop:maildrop:0.51c:*:*:*:*:*:*:*
- cpe:2.3:a:maildrop:maildrop:0.54:*:*:*:*:*:*:*
- cpe:2.3:a:maildrop:maildrop:0.70:*:*:*:*:*:*:*
- cpe:2.3:a:maildrop:maildrop:0.71:*:*:*:*:*:*:*
- cpe:2.3:a:maildrop:maildrop:0.72:*:*:*:*:*:*:*
- cpe:2.3:a:maildrop:maildrop:0.73:*:*:*:*:*:*:*
- cpe:2.3:a:maildrop:maildrop:0.74:*:*:*:*:*:*:*
- cpe:2.3:a:maildrop:maildrop:1.3.4:*:*:*:*:*:*:*
- cpe:2.3:a:maildrop:maildrop:1.3.5:*:*:*:*:*:*:*
- cpe:2.3:a:maildrop:maildrop:1.3.6:*:*:*:*:*:*:*
- cpe:2.3:a:maildrop:maildrop:1.3.7:*:*:*:*:*:*:*
- cpe:2.3:a:maildrop:maildrop:1.5.0:*:*:*:*:*:*:*
- cpe:2.3:a:maildrop:maildrop:0.54b:*:*:*:*:*:*:*
- cpe:2.3:a:maildrop:maildrop:0.55a:*:*:*:*:*:*:*
- cpe:2.3:a:maildrop:maildrop:0.62:*:*:*:*:*:*:*
- cpe:2.3:a:maildrop:maildrop:0.64:*:*:*:*:*:*:*
- cpe:2.3:a:maildrop:maildrop:0.75:*:*:*:*:*:*:*
- cpe:2.3:a:maildrop:maildrop:0.99.1:*:*:*:*:*:*:*
- cpe:2.3:a:maildrop:maildrop:1.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:maildrop:maildrop:1.3.3:*:*:*:*:*:*:*
- cpe:2.3:a:maildrop:maildrop:1.3.8:*:*:*:*:*:*:*
- cpe:2.3:a:maildrop:maildrop:1.4.0:*:*:*:*:*:*:*
- cpe:2.3:a:maildrop:maildrop:2.0.4:*:*:*:*:*:*:*
- cpe:2.3:a:maildrop:maildrop:2.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:maildrop:maildrop:1.6.2:*:*:*:*:*:*:*
- cpe:2.3:a:maildrop:maildrop:2.2:*:*:*:*:*:*:*
- cpe:2.3:a:maildrop:maildrop:2.1:*:*:*:*:*:*:*
- cpe:2.3:a:maildrop:maildrop:1.7.0:*:*:*:*:*:*:*
- cpe:2.3:a:maildrop:maildrop:1.6.3:*:*:*:*:*:*:*
- cpe:2.3:a:maildrop:maildrop:2.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:maildrop:maildrop:1.8.1:*:*:*:*:*:*:*
- cpe:2.3:a:maildrop:maildrop:2.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:maildrop:maildrop:2.0.1:*:*:*:*:*:*:*