PT-2003-1049 · Gnu · Shadow-Utils

Publicado 2003-02-20 · Atualizado 2008-09-10 · CVE-2002-1509

Positive Technologies (AI Summary)

CVSS v2.0

3.6

Baixa

Vetor base

AV:L/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions shadow-utils version 20000902

Description The issue allows other users in the same group to read or modify the new user's incoming email due to the creation of mail spool files with read/write privileges of the new user's group. This can lead to a violation of confidentiality and integrity of protected information. The exploitation of this issue can be carried out locally.

Recommendations For shadow-utils version 20000902, consider changing the permissions of the mail spool files to prevent other users in the same group from reading or modifying the new user's incoming email. As a temporary workaround, restrict access to the mail spool files until a patch is available.

Correção

Identificadores relacionados

BDU:2015-07786

CVE-2002-1509

Produtos afetados

Shadow-Utils

Referências · 7

• http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=75418 · Aviso do Fabricante
• http://mandrakesoft.com/security/advisories?name=MDKSA-2003:026 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2015-07786 · Nota de Segurança
• http://redhat.com/support/errata/RHSA-2003-058.html · Aviso do Fabricante
• http://redhat.com/support/errata/RHSA-2003-057.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2002-1509 · Nota de Segurança
• https://rhn.redhat.com/errata/RHSA-2003-057.html · Nota