PT-2003-2269 · Elm · Elm Me+

Published 2003-12-31 · Updated 2008-09-05 · CVE-2003-1324

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Elm ME+ version 2.4

Description A race condition exists in the can open function of Elm ME+, which can be exploited by local users to read and modify certain files with the privileges of the mail group. This issue occurs when Elm ME+ is installed setgid mail and the operating system lacks POSIX saved ID support.

Recommendations For Elm ME+ version 2.4, consider restricting access to the can open function until a patch is available, or apply configuration changes to mitigate the risk of exploitation, such as ensuring the operating system has POSIX saved ID support enabled.

Fix

Related Identifiers

CVE-2003-1324

Affected Products

Elm Me+

References · 2

• http://elmme-mailer.org/elm-2.4ME+PL109S.patch.gz · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2003-1324 · Security Note